drivers/net/wireless/b43/main.c

   1 /*
   2
   3   Broadcom B43 wireless driver
   4
   5   Copyright (c) 2005 Martin Langer <martin-langer@gmx.de>
   6   Copyright (c) 2005 Stefano Brivio <stefano.brivio@polimi.it>
   7   Copyright (c) 2005-2009 Michael Buesch <m@bues.ch>
   8   Copyright (c) 2005 Danny van Dyk <kugelfang@gentoo.org>
   9   Copyright (c) 2005 Andreas Jaggi <andreas.jaggi@waterwave.ch>
  10
  11   SDIO support
  12   Copyright (c) 2009 Albert Herranz <albert_herranz@yahoo.es>
  13
  14   Some parts of the code in this file are derived from the ipw2200
  15   driver  Copyright(c) 2003 - 2004 Intel Corporation.
  16
  17   This program is free software; you can redistribute it and/or modify
  18   it under the terms of the GNU General Public License as published by
  19   the Free Software Foundation; either version 2 of the License, or
  20   (at your option) any later version.
  21
  22   This program is distributed in the hope that it will be useful,
  23   but WITHOUT ANY WARRANTY; without even the implied warranty of
  24   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25   GNU General Public License for more details.
  26
  27   You should have received a copy of the GNU General Public License
  28   along with this program; see the file COPYING.  If not, write to
  29   the Free Software Foundation, Inc., 51 Franklin Steet, Fifth Floor,
  30   Boston, MA 02110-1301, USA.
  31
  32 */
  33
  34 #include <linux/delay.h>
  35 #include <linux/init.h>
  36 #include <linux/moduleparam.h>
  37 #include <linux/if_arp.h>
  38 #include <linux/etherdevice.h>
  39 #include <linux/firmware.h>
  40 #include <linux/wireless.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/io.h>
  44 #include <linux/dma-mapping.h>
  45 #include <linux/slab.h>
  46 #include <asm/unaligned.h>
  47
  48 #include "b43.h"
  49 #include "main.h"
  50 #include "debugfs.h"
  51 #include "phy_common.h"
  52 #include "phy_g.h"
  53 #include "phy_n.h"
  54 #include "dma.h"
  55 #include "pio.h"
  56 #include "sysfs.h"
  57 #include "xmit.h"
  58 #include "lo.h"
  59 #include "pcmcia.h"
  60 #include "sdio.h"
  61 #include <linux/mmc/sdio_func.h>
  62
  63 MODULE_DESCRIPTION("Broadcom B43 wireless driver");
  64 MODULE_AUTHOR("Martin Langer");
  65 MODULE_AUTHOR("Stefano Brivio");
  66 MODULE_AUTHOR("Michael Buesch");
  67 MODULE_AUTHOR("Gábor Stefanik");
  68 MODULE_LICENSE("GPL");
  69
  70 MODULE_FIRMWARE(B43_SUPPORTED_FIRMWARE_ID);
  71 MODULE_FIRMWARE("b43/ucode11.fw");
  72 MODULE_FIRMWARE("b43/ucode13.fw");
  73 MODULE_FIRMWARE("b43/ucode14.fw");
  74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 MODULE_FIRMWARE("b43/ucode16_mimo.fw");
  76 MODULE_FIRMWARE("b43/ucode5.fw");
  77 MODULE_FIRMWARE("b43/ucode9.fw");
  78
  79 static int modparam_bad_frames_preempt;
  80 module_param_named(bad_frames_preempt, modparam_bad_frames_preempt, int, 0444);
  81 MODULE_PARM_DESC(bad_frames_preempt,
  82                  "enable(1) / disable(0) Bad Frames Preemption");
  83
  84 static char modparam_fwpostfix[16];
  85 module_param_string(fwpostfix, modparam_fwpostfix, 16, 0444);
  86 MODULE_PARM_DESC(fwpostfix, "Postfix for the .fw files to load.");
  87
  88 static int modparam_hwpctl;
  89 module_param_named(hwpctl, modparam_hwpctl, int, 0444);
  90 MODULE_PARM_DESC(hwpctl, "Enable hardware-side power control (default off)");
  91
  92 static int modparam_nohwcrypt;
  93 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
  94 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
  95
  96 static int modparam_hwtkip;
  97 module_param_named(hwtkip, modparam_hwtkip, int, 0444);
  98 MODULE_PARM_DESC(hwtkip, "Enable hardware tkip.");
  99
 100 static int modparam_qos = 1;
 101 module_param_named(qos, modparam_qos, int, 0444);
 102 MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
 103
 104 static int modparam_btcoex = 1;
 105 module_param_named(btcoex, modparam_btcoex, int, 0444);
 106 MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistence (default on)");
 107
 108 int b43_modparam_verbose = B43_VERBOSITY_DEFAULT;
 109 module_param_named(verbose, b43_modparam_verbose, int, 0644);
 110 MODULE_PARM_DESC(verbose, "Log message verbosity: 0=error, 1=warn, 2=info(default), 3=debug");
 111
 112 static int b43_modparam_pio = B43_PIO_DEFAULT;
 113 module_param_named(pio, b43_modparam_pio, int, 0644);
 114 MODULE_PARM_DESC(pio, "Use PIO accesses by default: 0=DMA, 1=PIO");
 115
 116 #ifdef CONFIG_B43_BCMA
 117 static const struct bcma_device_id b43_bcma_tbl[] = {
 118         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x17, BCMA_ANY_CLASS),
 119         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x18, BCMA_ANY_CLASS),
 120         BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 0x1D, BCMA_ANY_CLASS),
 121         BCMA_CORETABLE_END
 122 };
 123 MODULE_DEVICE_TABLE(bcma, b43_bcma_tbl);
 124 #endif
 125
 126 #ifdef CONFIG_B43_SSB
 127 static const struct ssb_device_id b43_ssb_tbl[] = {
 128         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
 129         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
 130         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 7),
 131         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 9),
 132         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 10),
 133         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 11),
 134         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 12),
 135         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 13),
 136         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 15),
 137         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 16),
 138         SSB_DEVTABLE_END
 139 };
 140 MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
 141 #endif
 142
 143 /* Channel and ratetables are shared for all devices.
 144  * They can't be const, because ieee80211 puts some precalculated
 145  * data in there. This data is the same for all devices, so we don't
 146  * get concurrency issues */
 147 #define RATETAB_ENT(_rateid, _flags) \
 148         {                                                               \
 149                 .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
 150                 .hw_value       = (_rateid),                            \
 151                 .flags          = (_flags),                             \
 152         }
 153
 154 /*
 155  * NOTE: When changing this, sync with xmit.c's
 156  *       b43_plcp_get_bitrate_idx_* functions!
 157  */
 158 static struct ieee80211_rate __b43_ratetable[] = {
 159         RATETAB_ENT(B43_CCK_RATE_1MB, 0),
 160         RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
 161         RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
 162         RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
 163         RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
 164         RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
 165         RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
 166         RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
 167         RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
 168         RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
 169         RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
 170         RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 171 };
 172
 173 #define b43_a_ratetable         (__b43_ratetable + 4)
 174 #define b43_a_ratetable_size    8
 175 #define b43_b_ratetable         (__b43_ratetable + 0)
 176 #define b43_b_ratetable_size    4
 177 #define b43_g_ratetable         (__b43_ratetable + 0)
 178 #define b43_g_ratetable_size    12
 179
 180 #define CHAN4G(_channel, _freq, _flags) {                       \
 181         .band                   = IEEE80211_BAND_2GHZ,          \
 182         .center_freq            = (_freq),                      \
 183         .hw_value               = (_channel),                   \
 184         .flags                  = (_flags),                     \
 185         .max_antenna_gain       = 0,                            \
 186         .max_power              = 30,                           \
 187 }
 188 static struct ieee80211_channel b43_2ghz_chantable[] = {
 189         CHAN4G(1, 2412, 0),
 190         CHAN4G(2, 2417, 0),
 191         CHAN4G(3, 2422, 0),
 192         CHAN4G(4, 2427, 0),
 193         CHAN4G(5, 2432, 0),
 194         CHAN4G(6, 2437, 0),
 195         CHAN4G(7, 2442, 0),
 196         CHAN4G(8, 2447, 0),
 197         CHAN4G(9, 2452, 0),
 198         CHAN4G(10, 2457, 0),
 199         CHAN4G(11, 2462, 0),
 200         CHAN4G(12, 2467, 0),
 201         CHAN4G(13, 2472, 0),
 202         CHAN4G(14, 2484, 0),
 203 };
 204 #undef CHAN4G
 205
 206 #define CHAN5G(_channel, _flags) {                              \
 207         .band                   = IEEE80211_BAND_5GHZ,          \
 208         .center_freq            = 5000 + (5 * (_channel)),      \
 209         .hw_value               = (_channel),                   \
 210         .flags                  = (_flags),                     \
 211         .max_antenna_gain       = 0,                            \
 212         .max_power              = 30,                           \
 213 }
 214 static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
 215         CHAN5G(32, 0),          CHAN5G(34, 0),
 216         CHAN5G(36, 0),          CHAN5G(38, 0),
 217         CHAN5G(40, 0),          CHAN5G(42, 0),
 218         CHAN5G(44, 0),          CHAN5G(46, 0),
 219         CHAN5G(48, 0),          CHAN5G(50, 0),
 220         CHAN5G(52, 0),          CHAN5G(54, 0),
 221         CHAN5G(56, 0),          CHAN5G(58, 0),
 222         CHAN5G(60, 0),          CHAN5G(62, 0),
 223         CHAN5G(64, 0),          CHAN5G(66, 0),
 224         CHAN5G(68, 0),          CHAN5G(70, 0),
 225         CHAN5G(72, 0),          CHAN5G(74, 0),
 226         CHAN5G(76, 0),          CHAN5G(78, 0),
 227         CHAN5G(80, 0),          CHAN5G(82, 0),
 228         CHAN5G(84, 0),          CHAN5G(86, 0),
 229         CHAN5G(88, 0),          CHAN5G(90, 0),
 230         CHAN5G(92, 0),          CHAN5G(94, 0),
 231         CHAN5G(96, 0),          CHAN5G(98, 0),
 232         CHAN5G(100, 0),         CHAN5G(102, 0),
 233         CHAN5G(104, 0),         CHAN5G(106, 0),
 234         CHAN5G(108, 0),         CHAN5G(110, 0),
 235         CHAN5G(112, 0),         CHAN5G(114, 0),
 236         CHAN5G(116, 0),         CHAN5G(118, 0),
 237         CHAN5G(120, 0),         CHAN5G(122, 0),
 238         CHAN5G(124, 0),         CHAN5G(126, 0),
 239         CHAN5G(128, 0),         CHAN5G(130, 0),
 240         CHAN5G(132, 0),         CHAN5G(134, 0),
 241         CHAN5G(136, 0),         CHAN5G(138, 0),
 242         CHAN5G(140, 0),         CHAN5G(142, 0),
 243         CHAN5G(144, 0),         CHAN5G(145, 0),
 244         CHAN5G(146, 0),         CHAN5G(147, 0),
 245         CHAN5G(148, 0),         CHAN5G(149, 0),
 246         CHAN5G(150, 0),         CHAN5G(151, 0),
 247         CHAN5G(152, 0),         CHAN5G(153, 0),
 248         CHAN5G(154, 0),         CHAN5G(155, 0),
 249         CHAN5G(156, 0),         CHAN5G(157, 0),
 250         CHAN5G(158, 0),         CHAN5G(159, 0),
 251         CHAN5G(160, 0),         CHAN5G(161, 0),
 252         CHAN5G(162, 0),         CHAN5G(163, 0),
 253         CHAN5G(164, 0),         CHAN5G(165, 0),
 254         CHAN5G(166, 0),         CHAN5G(168, 0),
 255         CHAN5G(170, 0),         CHAN5G(172, 0),
 256         CHAN5G(174, 0),         CHAN5G(176, 0),
 257         CHAN5G(178, 0),         CHAN5G(180, 0),
 258         CHAN5G(182, 0),         CHAN5G(184, 0),
 259         CHAN5G(186, 0),         CHAN5G(188, 0),
 260         CHAN5G(190, 0),         CHAN5G(192, 0),
 261         CHAN5G(194, 0),         CHAN5G(196, 0),
 262         CHAN5G(198, 0),         CHAN5G(200, 0),
 263         CHAN5G(202, 0),         CHAN5G(204, 0),
 264         CHAN5G(206, 0),         CHAN5G(208, 0),
 265         CHAN5G(210, 0),         CHAN5G(212, 0),
 266         CHAN5G(214, 0),         CHAN5G(216, 0),
 267         CHAN5G(218, 0),         CHAN5G(220, 0),
 268         CHAN5G(222, 0),         CHAN5G(224, 0),
 269         CHAN5G(226, 0),         CHAN5G(228, 0),
 270 };
 271
 272 static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
 273         CHAN5G(34, 0),          CHAN5G(36, 0),
 274         CHAN5G(38, 0),          CHAN5G(40, 0),
 275         CHAN5G(42, 0),          CHAN5G(44, 0),
 276         CHAN5G(46, 0),          CHAN5G(48, 0),
 277         CHAN5G(52, 0),          CHAN5G(56, 0),
 278         CHAN5G(60, 0),          CHAN5G(64, 0),
 279         CHAN5G(100, 0),         CHAN5G(104, 0),
 280         CHAN5G(108, 0),         CHAN5G(112, 0),
 281         CHAN5G(116, 0),         CHAN5G(120, 0),
 282         CHAN5G(124, 0),         CHAN5G(128, 0),
 283         CHAN5G(132, 0),         CHAN5G(136, 0),
 284         CHAN5G(140, 0),         CHAN5G(149, 0),
 285         CHAN5G(153, 0),         CHAN5G(157, 0),
 286         CHAN5G(161, 0),         CHAN5G(165, 0),
 287         CHAN5G(184, 0),         CHAN5G(188, 0),
 288         CHAN5G(192, 0),         CHAN5G(196, 0),
 289         CHAN5G(200, 0),         CHAN5G(204, 0),
 290         CHAN5G(208, 0),         CHAN5G(212, 0),
 291         CHAN5G(216, 0),
 292 };
 293 #undef CHAN5G
 294
 295 static struct ieee80211_supported_band b43_band_5GHz_nphy = {
 296         .band           = IEEE80211_BAND_5GHZ,
 297         .channels       = b43_5ghz_nphy_chantable,
 298         .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
 299         .bitrates       = b43_a_ratetable,
 300         .n_bitrates     = b43_a_ratetable_size,
 301 };
 302
 303 static struct ieee80211_supported_band b43_band_5GHz_aphy = {
 304         .band           = IEEE80211_BAND_5GHZ,
 305         .channels       = b43_5ghz_aphy_chantable,
 306         .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
 307         .bitrates       = b43_a_ratetable,
 308         .n_bitrates     = b43_a_ratetable_size,
 309 };
 310
 311 static struct ieee80211_supported_band b43_band_2GHz = {
 312         .band           = IEEE80211_BAND_2GHZ,
 313         .channels       = b43_2ghz_chantable,
 314         .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
 315         .bitrates       = b43_g_ratetable,
 316         .n_bitrates     = b43_g_ratetable_size,
 317 };
 318
 319 static void b43_wireless_core_exit(struct b43_wldev *dev);
 320 static int b43_wireless_core_init(struct b43_wldev *dev);
 321 static struct b43_wldev * b43_wireless_core_stop(struct b43_wldev *dev);
 322 static int b43_wireless_core_start(struct b43_wldev *dev);
 323
 324 static int b43_ratelimit(struct b43_wl *wl)
 325 {
 326         if (!wl || !wl->current_dev)
 327                 return 1;
 328         if (b43_status(wl->current_dev) < B43_STAT_STARTED)
 329                 return 1;
 330         /* We are up and running.
 331          * Ratelimit the messages to avoid DoS over the net. */
 332         return net_ratelimit();
 333 }
 334
 335 void b43info(struct b43_wl *wl, const char *fmt, ...)
 336 {
 337         struct va_format vaf;
 338         va_list args;
 339
 340         if (b43_modparam_verbose < B43_VERBOSITY_INFO)
 341                 return;
 342         if (!b43_ratelimit(wl))
 343                 return;
 344
 345         va_start(args, fmt);
 346
 347         vaf.fmt = fmt;
 348         vaf.va = &args;
 349
 350         printk(KERN_INFO "b43-%s: %pV",
 351                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 352
 353         va_end(args);
 354 }
 355
 356 void b43err(struct b43_wl *wl, const char *fmt, ...)
 357 {
 358         struct va_format vaf;
 359         va_list args;
 360
 361         if (b43_modparam_verbose < B43_VERBOSITY_ERROR)
 362                 return;
 363         if (!b43_ratelimit(wl))
 364                 return;
 365
 366         va_start(args, fmt);
 367
 368         vaf.fmt = fmt;
 369         vaf.va = &args;
 370
 371         printk(KERN_ERR "b43-%s ERROR: %pV",
 372                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 373
 374         va_end(args);
 375 }
 376
 377 void b43warn(struct b43_wl *wl, const char *fmt, ...)
 378 {
 379         struct va_format vaf;
 380         va_list args;
 381
 382         if (b43_modparam_verbose < B43_VERBOSITY_WARN)
 383                 return;
 384         if (!b43_ratelimit(wl))
 385                 return;
 386
 387         va_start(args, fmt);
 388
 389         vaf.fmt = fmt;
 390         vaf.va = &args;
 391
 392         printk(KERN_WARNING "b43-%s warning: %pV",
 393                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 394
 395         va_end(args);
 396 }
 397
 398 void b43dbg(struct b43_wl *wl, const char *fmt, ...)
 399 {
 400         struct va_format vaf;
 401         va_list args;
 402
 403         if (b43_modparam_verbose < B43_VERBOSITY_DEBUG)
 404                 return;
 405
 406         va_start(args, fmt);
 407
 408         vaf.fmt = fmt;
 409         vaf.va = &args;
 410
 411         printk(KERN_DEBUG "b43-%s debug: %pV",
 412                (wl && wl->hw) ? wiphy_name(wl->hw->wiphy) : "wlan", &vaf);
 413
 414         va_end(args);
 415 }
 416
 417 static void b43_ram_write(struct b43_wldev *dev, u16 offset, u32 val)
 418 {
 419         u32 macctl;
 420
 421         B43_WARN_ON(offset % 4 != 0);
 422
 423         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 424         if (macctl & B43_MACCTL_BE)
 425                 val = swab32(val);
 426
 427         b43_write32(dev, B43_MMIO_RAM_CONTROL, offset);
 428         mmiowb();
 429         b43_write32(dev, B43_MMIO_RAM_DATA, val);
 430 }
 431
 432 static inline void b43_shm_control_word(struct b43_wldev *dev,
 433                                         u16 routing, u16 offset)
 434 {
 435         u32 control;
 436
 437         /* "offset" is the WORD offset. */
 438         control = routing;
 439         control <<= 16;
 440         control |= offset;
 441         b43_write32(dev, B43_MMIO_SHM_CONTROL, control);
 442 }
 443
 444 u32 b43_shm_read32(struct b43_wldev *dev, u16 routing, u16 offset)
 445 {
 446         u32 ret;
 447
 448         if (routing == B43_SHM_SHARED) {
 449                 B43_WARN_ON(offset & 0x0001);
 450                 if (offset & 0x0003) {
 451                         /* Unaligned access */
 452                         b43_shm_control_word(dev, routing, offset >> 2);
 453                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 454                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 455                         ret |= ((u32)b43_read16(dev, B43_MMIO_SHM_DATA)) << 16;
 456
 457                         goto out;
 458                 }
 459                 offset >>= 2;
 460         }
 461         b43_shm_control_word(dev, routing, offset);
 462         ret = b43_read32(dev, B43_MMIO_SHM_DATA);
 463 out:
 464         return ret;
 465 }
 466
 467 u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset)
 468 {
 469         u16 ret;
 470
 471         if (routing == B43_SHM_SHARED) {
 472                 B43_WARN_ON(offset & 0x0001);
 473                 if (offset & 0x0003) {
 474                         /* Unaligned access */
 475                         b43_shm_control_word(dev, routing, offset >> 2);
 476                         ret = b43_read16(dev, B43_MMIO_SHM_DATA_UNALIGNED);
 477
 478                         goto out;
 479                 }
 480                 offset >>= 2;
 481         }
 482         b43_shm_control_word(dev, routing, offset);
 483         ret = b43_read16(dev, B43_MMIO_SHM_DATA);
 484 out:
 485         return ret;
 486 }
 487
 488 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value)
 489 {
 490         if (routing == B43_SHM_SHARED) {
 491                 B43_WARN_ON(offset & 0x0001);
 492                 if (offset & 0x0003) {
 493                         /* Unaligned access */
 494                         b43_shm_control_word(dev, routing, offset >> 2);
 495                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED,
 496                                     value & 0xFFFF);
 497                         b43_shm_control_word(dev, routing, (offset >> 2) + 1);
 498                         b43_write16(dev, B43_MMIO_SHM_DATA,
 499                                     (value >> 16) & 0xFFFF);
 500                         return;
 501                 }
 502                 offset >>= 2;
 503         }
 504         b43_shm_control_word(dev, routing, offset);
 505         b43_write32(dev, B43_MMIO_SHM_DATA, value);
 506 }
 507
 508 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value)
 509 {
 510         if (routing == B43_SHM_SHARED) {
 511                 B43_WARN_ON(offset & 0x0001);
 512                 if (offset & 0x0003) {
 513                         /* Unaligned access */
 514                         b43_shm_control_word(dev, routing, offset >> 2);
 515                         b43_write16(dev, B43_MMIO_SHM_DATA_UNALIGNED, value);
 516                         return;
 517                 }
 518                 offset >>= 2;
 519         }
 520         b43_shm_control_word(dev, routing, offset);
 521         b43_write16(dev, B43_MMIO_SHM_DATA, value);
 522 }
 523
 524 /* Read HostFlags */
 525 u64 b43_hf_read(struct b43_wldev *dev)
 526 {
 527         u64 ret;
 528
 529         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
 530         ret <<= 16;
 531         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
 532         ret <<= 16;
 533         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 534
 535         return ret;
 536 }
 537
 538 /* Write HostFlags */
 539 void b43_hf_write(struct b43_wldev *dev, u64 value)
 540 {
 541         u16 lo, mi, hi;
 542
 543         lo = (value & 0x00000000FFFFULL);
 544         mi = (value & 0x0000FFFF0000ULL) >> 16;
 545         hi = (value & 0xFFFF00000000ULL) >> 32;
 546         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
 547         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
 548         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 549 }
 550
 551 /* Read the firmware capabilities bitmask (Opensource firmware only) */
 552 static u16 b43_fwcapa_read(struct b43_wldev *dev)
 553 {
 554         B43_WARN_ON(!dev->fw.opensource);
 555         return b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_FWCAPA);
 556 }
 557
 558 void b43_tsf_read(struct b43_wldev *dev, u64 *tsf)
 559 {
 560         u32 low, high;
 561
 562         B43_WARN_ON(dev->dev->core_rev < 3);
 563
 564         /* The hardware guarantees us an atomic read, if we
 565          * read the low register first. */
 566         low = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_LOW);
 567         high = b43_read32(dev, B43_MMIO_REV3PLUS_TSF_HIGH);
 568
 569         *tsf = high;
 570         *tsf <<= 32;
 571         *tsf |= low;
 572 }
 573
 574 static void b43_time_lock(struct b43_wldev *dev)
 575 {
 576         u32 macctl;
 577
 578         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 579         macctl |= B43_MACCTL_TBTTHOLD;
 580         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 581         /* Commit the write */
 582         b43_read32(dev, B43_MMIO_MACCTL);
 583 }
 584
 585 static void b43_time_unlock(struct b43_wldev *dev)
 586 {
 587         u32 macctl;
 588
 589         macctl = b43_read32(dev, B43_MMIO_MACCTL);
 590         macctl &= ~B43_MACCTL_TBTTHOLD;
 591         b43_write32(dev, B43_MMIO_MACCTL, macctl);
 592         /* Commit the write */
 593         b43_read32(dev, B43_MMIO_MACCTL);
 594 }
 595
 596 static void b43_tsf_write_locked(struct b43_wldev *dev, u64 tsf)
 597 {
 598         u32 low, high;
 599
 600         B43_WARN_ON(dev->dev->core_rev < 3);
 601
 602         low = tsf;
 603         high = (tsf >> 32);
 604         /* The hardware guarantees us an atomic write, if we
 605          * write the low register first. */
 606         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_LOW, low);
 607         mmiowb();
 608         b43_write32(dev, B43_MMIO_REV3PLUS_TSF_HIGH, high);
 609         mmiowb();
 610 }
 611
 612 void b43_tsf_write(struct b43_wldev *dev, u64 tsf)
 613 {
 614         b43_time_lock(dev);
 615         b43_tsf_write_locked(dev, tsf);
 616         b43_time_unlock(dev);
 617 }
 618
 619 static
 620 void b43_macfilter_set(struct b43_wldev *dev, u16 offset, const u8 *mac)
 621 {
 622         static const u8 zero_addr[ETH_ALEN] = { 0 };
 623         u16 data;
 624
 625         if (!mac)
 626                 mac = zero_addr;
 627
 628         offset |= 0x0020;
 629         b43_write16(dev, B43_MMIO_MACFILTER_CONTROL, offset);
 630
 631         data = mac[0];
 632         data |= mac[1] << 8;
 633         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 634         data = mac[2];
 635         data |= mac[3] << 8;
 636         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 637         data = mac[4];
 638         data |= mac[5] << 8;
 639         b43_write16(dev, B43_MMIO_MACFILTER_DATA, data);
 640 }
 641
 642 static void b43_write_mac_bssid_templates(struct b43_wldev *dev)
 643 {
 644         const u8 *mac;
 645         const u8 *bssid;
 646         u8 mac_bssid[ETH_ALEN * 2];
 647         int i;
 648         u32 tmp;
 649
 650         bssid = dev->wl->bssid;
 651         mac = dev->wl->mac_addr;
 652
 653         b43_macfilter_set(dev, B43_MACFILTER_BSSID, bssid);
 654
 655         memcpy(mac_bssid, mac, ETH_ALEN);
 656         memcpy(mac_bssid + ETH_ALEN, bssid, ETH_ALEN);
 657
 658         /* Write our MAC address and BSSID to template ram */
 659         for (i = 0; i < ARRAY_SIZE(mac_bssid); i += sizeof(u32)) {
 660                 tmp = (u32) (mac_bssid[i + 0]);
 661                 tmp |= (u32) (mac_bssid[i + 1]) << 8;
 662                 tmp |= (u32) (mac_bssid[i + 2]) << 16;
 663                 tmp |= (u32) (mac_bssid[i + 3]) << 24;
 664                 b43_ram_write(dev, 0x20 + i, tmp);
 665         }
 666 }
 667
 668 static void b43_upload_card_macaddress(struct b43_wldev *dev)
 669 {
 670         b43_write_mac_bssid_templates(dev);
 671         b43_macfilter_set(dev, B43_MACFILTER_SELF, dev->wl->mac_addr);
 672 }
 673
 674 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 675 {
 676         /* slot_time is in usec. */
 677         /* This test used to exit for all but a G PHY. */
 678         if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
 679                 return;
 680         b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
 681         /* Shared memory location 0x0010 is the slot time and should be
 682          * set to slot_time; however, this register is initially 0 and changing
 683          * the value adversely affects the transmit rate for BCM4311
 684          * devices. Until this behavior is unterstood, delete this step
 685          *
 686          * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 687          */
 688 }
 689
 690 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
 691 {
 692         b43_set_slot_time(dev, 9);
 693 }
 694
 695 static void b43_short_slot_timing_disable(struct b43_wldev *dev)
 696 {
 697         b43_set_slot_time(dev, 20);
 698 }
 699
 700 /* DummyTransmission function, as documented on
 701  * http://bcm-v4.sipsolutions.net/802.11/DummyTransmission
 702  */
 703 void b43_dummy_transmission(struct b43_wldev *dev, bool ofdm, bool pa_on)
 704 {
 705         struct b43_phy *phy = &dev->phy;
 706         unsigned int i, max_loop;
 707         u16 value;
 708         u32 buffer[5] = {
 709                 0x00000000,
 710                 0x00D40000,
 711                 0x00000000,
 712                 0x01000000,
 713                 0x00000000,
 714         };
 715
 716         if (ofdm) {
 717                 max_loop = 0x1E;
 718                 buffer[0] = 0x000201CC;
 719         } else {
 720                 max_loop = 0xFA;
 721                 buffer[0] = 0x000B846E;
 722         }
 723
 724         for (i = 0; i < 5; i++)
 725                 b43_ram_write(dev, i * 4, buffer[i]);
 726
 727         b43_write16(dev, 0x0568, 0x0000);
 728         if (dev->dev->core_rev < 11)
 729                 b43_write16(dev, 0x07C0, 0x0000);
 730         else
 731                 b43_write16(dev, 0x07C0, 0x0100);
 732         value = (ofdm ? 0x41 : 0x40);
 733         b43_write16(dev, 0x050C, value);
 734         if ((phy->type == B43_PHYTYPE_N) || (phy->type == B43_PHYTYPE_LP))
 735                 b43_write16(dev, 0x0514, 0x1A02);
 736         b43_write16(dev, 0x0508, 0x0000);
 737         b43_write16(dev, 0x050A, 0x0000);
 738         b43_write16(dev, 0x054C, 0x0000);
 739         b43_write16(dev, 0x056A, 0x0014);
 740         b43_write16(dev, 0x0568, 0x0826);
 741         b43_write16(dev, 0x0500, 0x0000);
 742         if (!pa_on && (phy->type == B43_PHYTYPE_N)) {
 743                 //SPEC TODO
 744         }
 745
 746         switch (phy->type) {
 747         case B43_PHYTYPE_N:
 748                 b43_write16(dev, 0x0502, 0x00D0);
 749                 break;
 750         case B43_PHYTYPE_LP:
 751                 b43_write16(dev, 0x0502, 0x0050);
 752                 break;
 753         default:
 754                 b43_write16(dev, 0x0502, 0x0030);
 755         }
 756
 757         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 758                 b43_radio_write16(dev, 0x0051, 0x0017);
 759         for (i = 0x00; i < max_loop; i++) {
 760                 value = b43_read16(dev, 0x050E);
 761                 if (value & 0x0080)
 762                         break;
 763                 udelay(10);
 764         }
 765         for (i = 0x00; i < 0x0A; i++) {
 766                 value = b43_read16(dev, 0x050E);
 767                 if (value & 0x0400)
 768                         break;
 769                 udelay(10);
 770         }
 771         for (i = 0x00; i < 0x19; i++) {
 772                 value = b43_read16(dev, 0x0690);
 773                 if (!(value & 0x0100))
 774                         break;
 775                 udelay(10);
 776         }
 777         if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
 778                 b43_radio_write16(dev, 0x0051, 0x0037);
 779 }
 780
 781 static void key_write(struct b43_wldev *dev,
 782                       u8 index, u8 algorithm, const u8 *key)
 783 {
 784         unsigned int i;
 785         u32 offset;
 786         u16 value;
 787         u16 kidx;
 788
 789         /* Key index/algo block */
 790         kidx = b43_kidx_to_fw(dev, index);
 791         value = ((kidx << 4) | algorithm);
 792         b43_shm_write16(dev, B43_SHM_SHARED,
 793                         B43_SHM_SH_KEYIDXBLOCK + (kidx * 2), value);
 794
 795         /* Write the key to the Key Table Pointer offset */
 796         offset = dev->ktp + (index * B43_SEC_KEYSIZE);
 797         for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
 798                 value = key[i];
 799                 value |= (u16) (key[i + 1]) << 8;
 800                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i, value);
 801         }
 802 }
 803
 804 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 805 {
 806         u32 addrtmp[2] = { 0, 0, };
 807         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 808
 809         if (b43_new_kidx_api(dev))
 810                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 811
 812         B43_WARN_ON(index < pairwise_keys_start);
 813         /* We have four default TX keys and possibly four default RX keys.
 814          * Physical mac 0 is mapped to physical key 4 or 8, depending
 815          * on the firmware version.
 816          * So we must adjust the index here.
 817          */
 818         index -= pairwise_keys_start;
 819         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 820
 821         if (addr) {
 822                 addrtmp[0] = addr[0];
 823                 addrtmp[0] |= ((u32) (addr[1]) << 8);
 824                 addrtmp[0] |= ((u32) (addr[2]) << 16);
 825                 addrtmp[0] |= ((u32) (addr[3]) << 24);
 826                 addrtmp[1] = addr[4];
 827                 addrtmp[1] |= ((u32) (addr[5]) << 8);
 828         }
 829
 830         /* Receive match transmitter address (RCMTA) mechanism */
 831         b43_shm_write32(dev, B43_SHM_RCMTA,
 832                         (index * 2) + 0, addrtmp[0]);
 833         b43_shm_write16(dev, B43_SHM_RCMTA,
 834                         (index * 2) + 1, addrtmp[1]);
 835 }
 836
 837 /* The ucode will use phase1 key with TEK key to decrypt rx packets.
 838  * When a packet is received, the iv32 is checked.
 839  * - if it doesn't the packet is returned without modification (and software
 840  *   decryption can be done). That's what happen when iv16 wrap.
 841  * - if it does, the rc4 key is computed, and decryption is tried.
 842  *   Either it will success and B43_RX_MAC_DEC is returned,
 843  *   either it fails and B43_RX_MAC_DEC|B43_RX_MAC_DECERR is returned
 844  *   and the packet is not usable (it got modified by the ucode).
 845  * So in order to never have B43_RX_MAC_DECERR, we should provide
 846  * a iv32 and phase1key that match. Because we drop packets in case of
 847  * B43_RX_MAC_DECERR, if we have a correct iv32 but a wrong phase1key, all
 848  * packets will be lost without higher layer knowing (ie no resync possible
 849  * until next wrap).
 850  *
 851  * NOTE : this should support 50 key like RCMTA because
 852  * (B43_SHM_SH_KEYIDXBLOCK - B43_SHM_SH_TKIPTSCTTAK)/14 = 50
 853  */
 854 static void rx_tkip_phase1_write(struct b43_wldev *dev, u8 index, u32 iv32,
 855                 u16 *phase1key)
 856 {
 857         unsigned int i;
 858         u32 offset;
 859         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 860
 861         if (!modparam_hwtkip)
 862                 return;
 863
 864         if (b43_new_kidx_api(dev))
 865                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 866
 867         B43_WARN_ON(index < pairwise_keys_start);
 868         /* We have four default TX keys and possibly four default RX keys.
 869          * Physical mac 0 is mapped to physical key 4 or 8, depending
 870          * on the firmware version.
 871          * So we must adjust the index here.
 872          */
 873         index -= pairwise_keys_start;
 874         B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 875
 876         if (b43_debug(dev, B43_DBG_KEYS)) {
 877                 b43dbg(dev->wl, "rx_tkip_phase1_write : idx 0x%x, iv32 0x%x\n",
 878                                 index, iv32);
 879         }
 880         /* Write the key to the  RX tkip shared mem */
 881         offset = B43_SHM_SH_TKIPTSCTTAK + index * (10 + 4);
 882         for (i = 0; i < 10; i += 2) {
 883                 b43_shm_write16(dev, B43_SHM_SHARED, offset + i,
 884                                 phase1key ? phase1key[i / 2] : 0);
 885         }
 886         b43_shm_write16(dev, B43_SHM_SHARED, offset + i, iv32);
 887         b43_shm_write16(dev, B43_SHM_SHARED, offset + i + 2, iv32 >> 16);
 888 }
 889
 890 static void b43_op_update_tkip_key(struct ieee80211_hw *hw,
 891                                    struct ieee80211_vif *vif,
 892                                    struct ieee80211_key_conf *keyconf,
 893                                    struct ieee80211_sta *sta,
 894                                    u32 iv32, u16 *phase1key)
 895 {
 896         struct b43_wl *wl = hw_to_b43_wl(hw);
 897         struct b43_wldev *dev;
 898         int index = keyconf->hw_key_idx;
 899
 900         if (B43_WARN_ON(!modparam_hwtkip))
 901                 return;
 902
 903         /* This is only called from the RX path through mac80211, where
 904          * our mutex is already locked. */
 905         B43_WARN_ON(!mutex_is_locked(&wl->mutex));
 906         dev = wl->current_dev;
 907         B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
 908
 909         keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
 910
 911         rx_tkip_phase1_write(dev, index, iv32, phase1key);
 912         /* only pairwise TKIP keys are supported right now */
 913         if (WARN_ON(!sta))
 914                 return;
 915         keymac_write(dev, index, sta->addr);
 916 }
 917
 918 static void do_key_write(struct b43_wldev *dev,
 919                          u8 index, u8 algorithm,
 920                          const u8 *key, size_t key_len, const u8 *mac_addr)
 921 {
 922         u8 buf[B43_SEC_KEYSIZE] = { 0, };
 923         u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 924
 925         if (b43_new_kidx_api(dev))
 926                 pairwise_keys_start = B43_NR_GROUP_KEYS;
 927
 928         B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
 929         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 930
 931         if (index >= pairwise_keys_start)
 932                 keymac_write(dev, index, NULL); /* First zero out mac. */
 933         if (algorithm == B43_SEC_ALGO_TKIP) {
 934                 /*
 935                  * We should provide an initial iv32, phase1key pair.
 936                  * We could start with iv32=0 and compute the corresponding
 937                  * phase1key, but this means calling ieee80211_get_tkip_key
 938                  * with a fake skb (or export other tkip function).
 939                  * Because we are lazy we hope iv32 won't start with
 940                  * 0xffffffff and let's b43_op_update_tkip_key provide a
 941                  * correct pair.
 942                  */
 943                 rx_tkip_phase1_write(dev, index, 0xffffffff, (u16*)buf);
 944         } else if (index >= pairwise_keys_start) /* clear it */
 945                 rx_tkip_phase1_write(dev, index, 0, NULL);
 946         if (key)
 947                 memcpy(buf, key, key_len);
 948         key_write(dev, index, algorithm, buf);
 949         if (index >= pairwise_keys_start)
 950                 keymac_write(dev, index, mac_addr);
 951
 952         dev->key[index].algorithm = algorithm;
 953 }
 954
 955 static int b43_key_write(struct b43_wldev *dev,
 956                          int index, u8 algorithm,
 957                          const u8 *key, size_t key_len,
 958                          const u8 *mac_addr,
 959                          struct ieee80211_key_conf *keyconf)
 960 {
 961         int i;
 962         int pairwise_keys_start;
 963
 964         /* For ALG_TKIP the key is encoded as a 256-bit (32 byte) data block:
 965          *      - Temporal Encryption Key (128 bits)
 966          *      - Temporal Authenticator Tx MIC Key (64 bits)
 967          *      - Temporal Authenticator Rx MIC Key (64 bits)
 968          *
 969          *      Hardware only store TEK
 970          */
 971         if (algorithm == B43_SEC_ALGO_TKIP && key_len == 32)
 972                 key_len = 16;
 973         if (key_len > B43_SEC_KEYSIZE)
 974                 return -EINVAL;
 975         for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
 976                 /* Check that we don't already have this key. */
 977                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
 978         }
 979         if (index < 0) {
 980                 /* Pairwise key. Get an empty slot for the key. */
 981                 if (b43_new_kidx_api(dev))
 982                         pairwise_keys_start = B43_NR_GROUP_KEYS;
 983                 else
 984                         pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 985                 for (i = pairwise_keys_start;
 986                      i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
 987                      i++) {
 988                         B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
 989                         if (!dev->key[i].keyconf) {
 990                                 /* found empty */
 991                                 index = i;
 992                                 break;
 993                         }
 994                 }
 995                 if (index < 0) {
 996                         b43warn(dev->wl, "Out of hardware key memory\n");
 997                         return -ENOSPC;
 998                 }
 999         } else
1000                 B43_WARN_ON(index > 3);
1001
1002         do_key_write(dev, index, algorithm, key, key_len, mac_addr);
1003         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1004                 /* Default RX key */
1005                 B43_WARN_ON(mac_addr);
1006                 do_key_write(dev, index + 4, algorithm, key, key_len, NULL);
1007         }
1008         keyconf->hw_key_idx = index;
1009         dev->key[index].keyconf = keyconf;
1010
1011         return 0;
1012 }
1013
1014 static int b43_key_clear(struct b43_wldev *dev, int index)
1015 {
1016         if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
1017                 return -EINVAL;
1018         do_key_write(dev, index, B43_SEC_ALGO_NONE,
1019                      NULL, B43_SEC_KEYSIZE, NULL);
1020         if ((index <= 3) && !b43_new_kidx_api(dev)) {
1021                 do_key_write(dev, index + 4, B43_SEC_ALGO_NONE,
1022                              NULL, B43_SEC_KEYSIZE, NULL);
1023         }
1024         dev->key[index].keyconf = NULL;
1025
1026         return 0;
1027 }
1028
1029 static void b43_clear_keys(struct b43_wldev *dev)
1030 {
1031         int i, count;
1032
1033         if (b43_new_kidx_api(dev))
1034                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1035         else
1036                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1037         for (i = 0; i < count; i++)
1038                 b43_key_clear(dev, i);
1039 }
1040
1041 static void b43_dump_keymemory(struct b43_wldev *dev)
1042 {
1043         unsigned int i, index, count, offset, pairwise_keys_start;
1044         u8 mac[ETH_ALEN];
1045         u16 algo;
1046         u32 rcmta0;
1047         u16 rcmta1;
1048         u64 hf;
1049         struct b43_key *key;
1050
1051         if (!b43_debug(dev, B43_DBG_KEYS))
1052                 return;
1053
1054         hf = b43_hf_read(dev);
1055         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
1056                !!(hf & B43_HF_USEDEFKEYS));
1057         if (b43_new_kidx_api(dev)) {
1058                 pairwise_keys_start = B43_NR_GROUP_KEYS;
1059                 count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
1060         } else {
1061                 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
1062                 count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
1063         }
1064         for (index = 0; index < count; index++) {
1065                 key = &(dev->key[index]);
1066                 printk(KERN_DEBUG "Key slot %02u: %s",
1067                        index, (key->keyconf == NULL) ? " " : "*");
1068                 offset = dev->ktp + (index * B43_SEC_KEYSIZE);
1069                 for (i = 0; i < B43_SEC_KEYSIZE; i += 2) {
1070                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1071                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1072                 }
1073
1074                 algo = b43_shm_read16(dev, B43_SHM_SHARED,
1075                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
1076                 printk("   Algo: %04X/%02X", algo, key->algorithm);
1077
1078                 if (index >= pairwise_keys_start) {
1079                         if (key->algorithm == B43_SEC_ALGO_TKIP) {
1080                                 printk("   TKIP: ");
1081                                 offset = B43_SHM_SH_TKIPTSCTTAK + (index - 4) * (10 + 4);
1082                                 for (i = 0; i < 14; i += 2) {
1083                                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, offset + i);
1084                                         printk("%02X%02X", (tmp & 0xFF), ((tmp >> 8) & 0xFF));
1085                                 }
1086                         }
1087                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
1088                                                 ((index - pairwise_keys_start) * 2) + 0);
1089                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
1090                                                 ((index - pairwise_keys_start) * 2) + 1);
1091                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
1092                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
1093                         printk("   MAC: %pM", mac);
1094                 } else
1095                         printk("   DEFAULT KEY");
1096                 printk("\n");
1097         }
1098 }
1099
1100 void b43_power_saving_ctl_bits(struct b43_wldev *dev, unsigned int ps_flags)
1101 {
1102         u32 macctl;
1103         u16 ucstat;
1104         bool hwps;
1105         bool awake;
1106         int i;
1107
1108         B43_WARN_ON((ps_flags & B43_PS_ENABLED) &&
1109                     (ps_flags & B43_PS_DISABLED));
1110         B43_WARN_ON((ps_flags & B43_PS_AWAKE) && (ps_flags & B43_PS_ASLEEP));
1111
1112         if (ps_flags & B43_PS_ENABLED) {
1113                 hwps = 1;
1114         } else if (ps_flags & B43_PS_DISABLED) {
1115                 hwps = 0;
1116         } else {
1117                 //TODO: If powersave is not off and FIXME is not set and we are not in adhoc
1118                 //      and thus is not an AP and we are associated, set bit 25
1119         }
1120         if (ps_flags & B43_PS_AWAKE) {
1121                 awake = 1;
1122         } else if (ps_flags & B43_PS_ASLEEP) {
1123                 awake = 0;
1124         } else {
1125                 //TODO: If the device is awake or this is an AP, or we are scanning, or FIXME,
1126                 //      or we are associated, or FIXME, or the latest PS-Poll packet sent was
1127                 //      successful, set bit26
1128         }
1129
1130 /* FIXME: For now we force awake-on and hwps-off */
1131         hwps = 0;
1132         awake = 1;
1133
1134         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1135         if (hwps)
1136                 macctl |= B43_MACCTL_HWPS;
1137         else
1138                 macctl &= ~B43_MACCTL_HWPS;
1139         if (awake)
1140                 macctl |= B43_MACCTL_AWAKE;
1141         else
1142                 macctl &= ~B43_MACCTL_AWAKE;
1143         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1144         /* Commit write */
1145         b43_read32(dev, B43_MMIO_MACCTL);
1146         if (awake && dev->dev->core_rev >= 5) {
1147                 /* Wait for the microcode to wake up. */
1148                 for (i = 0; i < 100; i++) {
1149                         ucstat = b43_shm_read16(dev, B43_SHM_SHARED,
1150                                                 B43_SHM_SH_UCODESTAT);
1151                         if (ucstat != B43_SHM_SH_UCODESTAT_SLEEP)
1152                                 break;
1153                         udelay(10);
1154                 }
1155         }
1156 }
1157
1158 #ifdef CONFIG_B43_BCMA
1159 static void b43_bcma_phy_reset(struct b43_wldev *dev)
1160 {
1161         u32 flags;
1162
1163         /* Put PHY into reset */
1164         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1165         flags |= B43_BCMA_IOCTL_PHY_RESET;
1166         flags |= B43_BCMA_IOCTL_PHY_BW_20MHZ; /* Make 20 MHz def */
1167         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1168         udelay(2);
1169
1170         /* Take PHY out of reset */
1171         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1172         flags &= ~B43_BCMA_IOCTL_PHY_RESET;
1173         flags |= BCMA_IOCTL_FGC;
1174         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1175         udelay(1);
1176
1177         /* Do not force clock anymore */
1178         flags = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
1179         flags &= ~BCMA_IOCTL_FGC;
1180         bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, flags);
1181         udelay(1);
1182 }
1183
1184 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1185 {
1186         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
1187         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
1188         b43_bcma_phy_reset(dev);
1189         bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
1190 }
1191 #endif
1192
1193 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1194 {
1195         struct ssb_device *sdev = dev->dev->sdev;
1196         u32 tmslow;
1197         u32 flags = 0;
1198
1199         if (gmode)
1200                 flags |= B43_TMSLOW_GMODE;
1201         flags |= B43_TMSLOW_PHYCLKEN;
1202         flags |= B43_TMSLOW_PHYRESET;
1203         if (dev->phy.type == B43_PHYTYPE_N)
1204                 flags |= B43_TMSLOW_PHY_BANDWIDTH_20MHZ; /* Make 20 MHz def */
1205         b43_device_enable(dev, flags);
1206         msleep(2);              /* Wait for the PLL to turn on. */
1207
1208         /* Now take the PHY out of Reset again */
1209         tmslow = ssb_read32(sdev, SSB_TMSLOW);
1210         tmslow |= SSB_TMSLOW_FGC;
1211         tmslow &= ~B43_TMSLOW_PHYRESET;
1212         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1213         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1214         msleep(1);
1215         tmslow &= ~SSB_TMSLOW_FGC;
1216         ssb_write32(sdev, SSB_TMSLOW, tmslow);
1217         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
1218         msleep(1);
1219 }
1220
1221 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
1222 {
1223         u32 macctl;
1224
1225         switch (dev->dev->bus_type) {
1226 #ifdef CONFIG_B43_BCMA
1227         case B43_BUS_BCMA:
1228                 b43_bcma_wireless_core_reset(dev, gmode);
1229                 break;
1230 #endif
1231 #ifdef CONFIG_B43_SSB
1232         case B43_BUS_SSB:
1233                 b43_ssb_wireless_core_reset(dev, gmode);
1234                 break;
1235 #endif
1236         }
1237
1238         /* Turn Analog ON, but only if we already know the PHY-type.
1239          * This protects against very early setup where we don't know the
1240          * PHY-type, yet. wireless_core_reset will be called once again later,
1241          * when we know the PHY-type. */
1242         if (dev->phy.ops)
1243                 dev->phy.ops->switch_analog(dev, 1);
1244
1245         macctl = b43_read32(dev, B43_MMIO_MACCTL);
1246         macctl &= ~B43_MACCTL_GMODE;
1247         if (gmode)
1248                 macctl |= B43_MACCTL_GMODE;
1249         macctl |= B43_MACCTL_IHR_ENABLED;
1250         b43_write32(dev, B43_MMIO_MACCTL, macctl);
1251 }
1252
1253 static void handle_irq_transmit_status(struct b43_wldev *dev)
1254 {
1255         u32 v0, v1;
1256         u16 tmp;
1257         struct b43_txstatus stat;
1258
1259         while (1) {
1260                 v0 = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1261                 if (!(v0 & 0x00000001))
1262                         break;
1263                 v1 = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1264
1265                 stat.cookie = (v0 >> 16);
1266                 stat.seq = (v1 & 0x0000FFFF);
1267                 stat.phy_stat = ((v1 & 0x00FF0000) >> 16);
1268                 tmp = (v0 & 0x0000FFFF);
1269                 stat.frame_count = ((tmp & 0xF000) >> 12);
1270                 stat.rts_count = ((tmp & 0x0F00) >> 8);
1271                 stat.supp_reason = ((tmp & 0x001C) >> 2);
1272                 stat.pm_indicated = !!(tmp & 0x0080);
1273                 stat.intermediate = !!(tmp & 0x0040);
1274                 stat.for_ampdu = !!(tmp & 0x0020);
1275                 stat.acked = !!(tmp & 0x0002);
1276
1277                 b43_handle_txstatus(dev, &stat);
1278         }
1279 }
1280
1281 static void drain_txstatus_queue(struct b43_wldev *dev)
1282 {
1283         u32 dummy;
1284
1285         if (dev->dev->core_rev < 5)
1286                 return;
1287         /* Read all entries from the microcode TXstatus FIFO
1288          * and throw them away.
1289          */
1290         while (1) {
1291                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_0);
1292                 if (!(dummy & 0x00000001))
1293                         break;
1294                 dummy = b43_read32(dev, B43_MMIO_XMITSTAT_1);
1295         }
1296 }
1297
1298 static u32 b43_jssi_read(struct b43_wldev *dev)
1299 {
1300         u32 val = 0;
1301
1302         val = b43_shm_read16(dev, B43_SHM_SHARED, 0x08A);
1303         val <<= 16;
1304         val |= b43_shm_read16(dev, B43_SHM_SHARED, 0x088);
1305
1306         return val;
1307 }
1308
1309 static void b43_jssi_write(struct b43_wldev *dev, u32 jssi)
1310 {
1311         b43_shm_write16(dev, B43_SHM_SHARED, 0x088, (jssi & 0x0000FFFF));
1312         b43_shm_write16(dev, B43_SHM_SHARED, 0x08A, (jssi & 0xFFFF0000) >> 16);
1313 }
1314
1315 static void b43_generate_noise_sample(struct b43_wldev *dev)
1316 {
1317         b43_jssi_write(dev, 0x7F7F7F7F);
1318         b43_write32(dev, B43_MMIO_MACCMD,
1319                     b43_read32(dev, B43_MMIO_MACCMD) | B43_MACCMD_BGNOISE);
1320 }
1321
1322 static void b43_calculate_link_quality(struct b43_wldev *dev)
1323 {
1324         /* Top half of Link Quality calculation. */
1325
1326         if (dev->phy.type != B43_PHYTYPE_G)
1327                 return;
1328         if (dev->noisecalc.calculation_running)
1329                 return;
1330         dev->noisecalc.calculation_running = 1;
1331         dev->noisecalc.nr_samples = 0;
1332
1333         b43_generate_noise_sample(dev);
1334 }
1335
1336 static void handle_irq_noise(struct b43_wldev *dev)
1337 {
1338         struct b43_phy_g *phy = dev->phy.g;
1339         u16 tmp;
1340         u8 noise[4];
1341         u8 i, j;
1342         s32 average;
1343
1344         /* Bottom half of Link Quality calculation. */
1345
1346         if (dev->phy.type != B43_PHYTYPE_G)
1347                 return;
1348
1349         /* Possible race condition: It might be possible that the user
1350          * changed to a different channel in the meantime since we
1351          * started the calculation. We ignore that fact, since it's
1352          * not really that much of a problem. The background noise is
1353          * an estimation only anyway. Slightly wrong results will get damped
1354          * by the averaging of the 8 sample rounds. Additionally the
1355          * value is shortlived. So it will be replaced by the next noise
1356          * calculation round soon. */
1357
1358         B43_WARN_ON(!dev->noisecalc.calculation_running);
1359         *((__le32 *)noise) = cpu_to_le32(b43_jssi_read(dev));
1360         if (noise[0] == 0x7F || noise[1] == 0x7F ||
1361             noise[2] == 0x7F || noise[3] == 0x7F)
1362                 goto generate_new;
1363
1364         /* Get the noise samples. */
1365         B43_WARN_ON(dev->noisecalc.nr_samples >= 8);
1366         i = dev->noisecalc.nr_samples;
1367         noise[0] = clamp_val(noise[0], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1368         noise[1] = clamp_val(noise[1], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1369         noise[2] = clamp_val(noise[2], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1370         noise[3] = clamp_val(noise[3], 0, ARRAY_SIZE(phy->nrssi_lt) - 1);
1371         dev->noisecalc.samples[i][0] = phy->nrssi_lt[noise[0]];
1372         dev->noisecalc.samples[i][1] = phy->nrssi_lt[noise[1]];
1373         dev->noisecalc.samples[i][2] = phy->nrssi_lt[noise[2]];
1374         dev->noisecalc.samples[i][3] = phy->nrssi_lt[noise[3]];
1375         dev->noisecalc.nr_samples++;
1376         if (dev->noisecalc.nr_samples == 8) {
1377                 /* Calculate the Link Quality by the noise samples. */
1378                 average = 0;
1379                 for (i = 0; i < 8; i++) {
1380                         for (j = 0; j < 4; j++)
1381                                 average += dev->noisecalc.samples[i][j];
1382                 }
1383                 average /= (8 * 4);
1384                 average *= 125;
1385                 average += 64;
1386                 average /= 128;
1387                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 0x40C);
1388                 tmp = (tmp / 128) & 0x1F;
1389                 if (tmp >= 8)
1390                         average += 2;
1391                 else
1392                         average -= 25;
1393                 if (tmp == 8)
1394                         average -= 72;
1395                 else
1396                         average -= 48;
1397
1398                 dev->stats.link_noise = average;
1399                 dev->noisecalc.calculation_running = 0;
1400                 return;
1401         }
1402 generate_new:
1403         b43_generate_noise_sample(dev);
1404 }
1405
1406 static void handle_irq_tbtt_indication(struct b43_wldev *dev)
1407 {
1408         if (b43_is_mode(dev->wl, NL80211_IFTYPE_AP)) {
1409                 ///TODO: PS TBTT
1410         } else {
1411                 if (1 /*FIXME: the last PSpoll frame was sent successfully */ )
1412                         b43_power_saving_ctl_bits(dev, 0);
1413         }
1414         if (b43_is_mode(dev->wl, NL80211_IFTYPE_ADHOC))
1415                 dev->dfq_valid = 1;
1416 }
1417
1418 static void handle_irq_atim_end(struct b43_wldev *dev)
1419 {
1420         if (dev->dfq_valid) {
1421                 b43_write32(dev, B43_MMIO_MACCMD,
1422                             b43_read32(dev, B43_MMIO_MACCMD)
1423                             | B43_MACCMD_DFQ_VALID);
1424                 dev->dfq_valid = 0;
1425         }
1426 }
1427
1428 static void handle_irq_pmq(struct b43_wldev *dev)
1429 {
1430         u32 tmp;
1431
1432         //TODO: AP mode.
1433
1434         while (1) {
1435                 tmp = b43_read32(dev, B43_MMIO_PS_STATUS);
1436                 if (!(tmp & 0x00000008))
1437                         break;
1438         }
1439         /* 16bit write is odd, but correct. */
1440         b43_write16(dev, B43_MMIO_PS_STATUS, 0x0002);
1441 }
1442
1443 static void b43_write_template_common(struct b43_wldev *dev,
1444                                       const u8 *data, u16 size,
1445                                       u16 ram_offset,
1446                                       u16 shm_size_offset, u8 rate)
1447 {
1448         u32 i, tmp;
1449         struct b43_plcp_hdr4 plcp;
1450
1451         plcp.data = 0;
1452         b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
1453         b43_ram_write(dev, ram_offset, le32_to_cpu(plcp.data));
1454         ram_offset += sizeof(u32);
1455         /* The PLCP is 6 bytes long, but we only wrote 4 bytes, yet.
1456          * So leave the first two bytes of the next write blank.
1457          */
1458         tmp = (u32) (data[0]) << 16;
1459         tmp |= (u32) (data[1]) << 24;
1460         b43_ram_write(dev, ram_offset, tmp);
1461         ram_offset += sizeof(u32);
1462         for (i = 2; i < size; i += sizeof(u32)) {
1463                 tmp = (u32) (data[i + 0]);
1464                 if (i + 1 < size)
1465                         tmp |= (u32) (data[i + 1]) << 8;
1466                 if (i + 2 < size)
1467                         tmp |= (u32) (data[i + 2]) << 16;
1468                 if (i + 3 < size)
1469                         tmp |= (u32) (data[i + 3]) << 24;
1470                 b43_ram_write(dev, ram_offset + i - 2, tmp);
1471         }
1472         b43_shm_write16(dev, B43_SHM_SHARED, shm_size_offset,
1473                         size + sizeof(struct b43_plcp_hdr6));
1474 }
1475
1476 /* Check if the use of the antenna that ieee80211 told us to
1477  * use is possible. This will fall back to DEFAULT.
1478  * "antenna_nr" is the antenna identifier we got from ieee80211. */
1479 u8 b43_ieee80211_antenna_sanitize(struct b43_wldev *dev,
1480                                   u8 antenna_nr)
1481 {
1482         u8 antenna_mask;
1483
1484         if (antenna_nr == 0) {
1485                 /* Zero means "use default antenna". That's always OK. */
1486                 return 0;
1487         }
1488
1489         /* Get the mask of available antennas. */
1490         if (dev->phy.gmode)
1491                 antenna_mask = dev->dev->bus_sprom->ant_available_bg;
1492         else
1493                 antenna_mask = dev->dev->bus_sprom->ant_available_a;
1494
1495         if (!(antenna_mask & (1 << (antenna_nr - 1)))) {
1496                 /* This antenna is not available. Fall back to default. */
1497                 return 0;
1498         }
1499
1500         return antenna_nr;
1501 }
1502
1503 /* Convert a b43 antenna number value to the PHY TX control value. */
1504 static u16 b43_antenna_to_phyctl(int antenna)
1505 {
1506         switch (antenna) {
1507         case B43_ANTENNA0:
1508                 return B43_TXH_PHY_ANT0;
1509         case B43_ANTENNA1:
1510                 return B43_TXH_PHY_ANT1;
1511         case B43_ANTENNA2:
1512                 return B43_TXH_PHY_ANT2;
1513         case B43_ANTENNA3:
1514                 return B43_TXH_PHY_ANT3;
1515         case B43_ANTENNA_AUTO0:
1516         case B43_ANTENNA_AUTO1:
1517                 return B43_TXH_PHY_ANT01AUTO;
1518         }
1519         B43_WARN_ON(1);
1520         return 0;
1521 }
1522
1523 static void b43_write_beacon_template(struct b43_wldev *dev,
1524                                       u16 ram_offset,
1525                                       u16 shm_size_offset)
1526 {
1527         unsigned int i, len, variable_len;
1528         const struct ieee80211_mgmt *bcn;
1529         const u8 *ie;
1530         bool tim_found = 0;
1531         unsigned int rate;
1532         u16 ctl;
1533         int antenna;
1534         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
1535
1536         bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
1537         len = min((size_t) dev->wl->current_beacon->len,
1538                   0x200 - sizeof(struct b43_plcp_hdr6));
1539         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
1540
1541         b43_write_template_common(dev, (const u8 *)bcn,
1542                                   len, ram_offset, shm_size_offset, rate);
1543
1544         /* Write the PHY TX control parameters. */
1545         antenna = B43_ANTENNA_DEFAULT;
1546         antenna = b43_antenna_to_phyctl(antenna);
1547         ctl = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL);
1548         /* We can't send beacons with short preamble. Would get PHY errors. */
1549         ctl &= ~B43_TXH_PHY_SHORTPRMBL;
1550         ctl &= ~B43_TXH_PHY_ANT;
1551         ctl &= ~B43_TXH_PHY_ENC;
1552         ctl |= antenna;
1553         if (b43_is_cck_rate(rate))
1554                 ctl |= B43_TXH_PHY_ENC_CCK;
1555         else
1556                 ctl |= B43_TXH_PHY_ENC_OFDM;
1557         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
1558
1559         /* Find the position of the TIM and the DTIM_period value
1560          * and write them to SHM. */
1561         ie = bcn->u.beacon.variable;
1562         variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
1563         for (i = 0; i < variable_len - 2; ) {
1564                 uint8_t ie_id, ie_len;
1565
1566                 ie_id = ie[i];
1567                 ie_len = ie[i + 1];
1568                 if (ie_id == 5) {
1569                         u16 tim_position;
1570                         u16 dtim_period;
1571                         /* This is the TIM Information Element */
1572
1573                         /* Check whether the ie_len is in the beacon data range. */
1574                         if (variable_len < ie_len + 2 + i)
1575                                 break;
1576                         /* A valid TIM is at least 4 bytes long. */
1577                         if (ie_len < 4)
1578                                 break;
1579                         tim_found = 1;
1580
1581                         tim_position = sizeof(struct b43_plcp_hdr6);
1582                         tim_position += offsetof(struct ieee80211_mgmt, u.beacon.variable);
1583                         tim_position += i;
1584
1585                         dtim_period = ie[i + 3];
1586
1587                         b43_shm_write16(dev, B43_SHM_SHARED,
1588                                         B43_SHM_SH_TIMBPOS, tim_position);
1589                         b43_shm_write16(dev, B43_SHM_SHARED,
1590                                         B43_SHM_SH_DTIMPER, dtim_period);
1591                         break;
1592                 }
1593                 i += ie_len + 2;
1594         }
1595         if (!tim_found) {
1596                 /*
1597                  * If ucode wants to modify TIM do it behind the beacon, this
1598                  * will happen, for example, when doing mesh networking.
1599                  */
1600                 b43_shm_write16(dev, B43_SHM_SHARED,
1601                                 B43_SHM_SH_TIMBPOS,
1602                                 len + sizeof(struct b43_plcp_hdr6));
1603                 b43_shm_write16(dev, B43_SHM_SHARED,
1604                                 B43_SHM_SH_DTIMPER, 0);
1605         }
1606         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
1607 }
1608
1609 static void b43_upload_beacon0(struct b43_wldev *dev)
1610 {
1611         struct b43_wl *wl = dev->wl;
1612
1613         if (wl->beacon0_uploaded)
1614                 return;
1615         b43_write_beacon_template(dev, 0x68, 0x18);
1616         wl->beacon0_uploaded = 1;
1617 }
1618
1619 static void b43_upload_beacon1(struct b43_wldev *dev)
1620 {
1621         struct b43_wl *wl = dev->wl;
1622
1623         if (wl->beacon1_uploaded)
1624                 return;
1625         b43_write_beacon_template(dev, 0x468, 0x1A);
1626         wl->beacon1_uploaded = 1;
1627 }
1628
1629 static void handle_irq_beacon(struct b43_wldev *dev)
1630 {
1631         struct b43_wl *wl = dev->wl;
1632         u32 cmd, beacon0_valid, beacon1_valid;
1633
1634         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
1635             !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
1636                 return;
1637
1638         /* This is the bottom half of the asynchronous beacon update. */
1639
1640         /* Ignore interrupt in the future. */
1641         dev->irq_mask &= ~B43_IRQ_BEACON;
1642
1643         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1644         beacon0_valid = (cmd & B43_MACCMD_BEACON0_VALID);
1645         beacon1_valid = (cmd & B43_MACCMD_BEACON1_VALID);
1646
1647         /* Schedule interrupt manually, if busy. */
1648         if (beacon0_valid && beacon1_valid) {
1649                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_BEACON);
1650                 dev->irq_mask |= B43_IRQ_BEACON;
1651                 return;
1652         }
1653
1654         if (unlikely(wl->beacon_templates_virgin)) {
1655                 /* We never uploaded a beacon before.
1656                  * Upload both templates now, but only mark one valid. */
1657                 wl->beacon_templates_virgin = 0;
1658                 b43_upload_beacon0(dev);
1659                 b43_upload_beacon1(dev);
1660                 cmd = b43_read32(dev, B43_MMIO_MACCMD);
1661                 cmd |= B43_MACCMD_BEACON0_VALID;
1662                 b43_write32(dev, B43_MMIO_MACCMD, cmd);
1663         } else {
1664                 if (!beacon0_valid) {
1665                         b43_upload_beacon0(dev);
1666                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1667                         cmd |= B43_MACCMD_BEACON0_VALID;
1668                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1669                 } else if (!beacon1_valid) {
1670                         b43_upload_beacon1(dev);
1671                         cmd = b43_read32(dev, B43_MMIO_MACCMD);
1672                         cmd |= B43_MACCMD_BEACON1_VALID;
1673                         b43_write32(dev, B43_MMIO_MACCMD, cmd);
1674                 }
1675         }
1676 }
1677
1678 static void b43_do_beacon_update_trigger_work(struct b43_wldev *dev)
1679 {
1680         u32 old_irq_mask = dev->irq_mask;
1681
1682         /* update beacon right away or defer to irq */
1683         handle_irq_beacon(dev);
1684         if (old_irq_mask != dev->irq_mask) {
1685                 /* The handler updated the IRQ mask. */
1686                 B43_WARN_ON(!dev->irq_mask);
1687                 if (b43_read32(dev, B43_MMIO_GEN_IRQ_MASK)) {
1688                         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1689                 } else {
1690                         /* Device interrupts are currently disabled. That means
1691                          * we just ran the hardirq handler and scheduled the
1692                          * IRQ thread. The thread will write the IRQ mask when
1693                          * it finished, so there's nothing to do here. Writing
1694                          * the mask _here_ would incorrectly re-enable IRQs. */
1695                 }
1696         }
1697 }
1698
1699 static void b43_beacon_update_trigger_work(struct work_struct *work)
1700 {
1701         struct b43_wl *wl = container_of(work, struct b43_wl,
1702                                          beacon_update_trigger);
1703         struct b43_wldev *dev;
1704
1705         mutex_lock(&wl->mutex);
1706         dev = wl->current_dev;
1707         if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED))) {
1708                 if (b43_bus_host_is_sdio(dev->dev)) {
1709                         /* wl->mutex is enough. */
1710                         b43_do_beacon_update_trigger_work(dev);
1711                         mmiowb();
1712                 } else {
1713                         spin_lock_irq(&wl->hardirq_lock);
1714                         b43_do_beacon_update_trigger_work(dev);
1715                         mmiowb();
1716                         spin_unlock_irq(&wl->hardirq_lock);
1717                 }
1718         }
1719         mutex_unlock(&wl->mutex);
1720 }
1721
1722 /* Asynchronously update the packet templates in template RAM.
1723  * Locking: Requires wl->mutex to be locked. */
1724 static void b43_update_templates(struct b43_wl *wl)
1725 {
1726         struct sk_buff *beacon;
1727
1728         /* This is the top half of the ansynchronous beacon update.
1729          * The bottom half is the beacon IRQ.
1730          * Beacon update must be asynchronous to avoid sending an
1731          * invalid beacon. This can happen for example, if the firmware
1732          * transmits a beacon while we are updating it. */
1733
1734         /* We could modify the existing beacon and set the aid bit in
1735          * the TIM field, but that would probably require resizing and
1736          * moving of data within the beacon template.
1737          * Simply request a new beacon and let mac80211 do the hard work. */
1738         beacon = ieee80211_beacon_get(wl->hw, wl->vif);
1739         if (unlikely(!beacon))
1740                 return;
1741
1742         if (wl->current_beacon)
1743                 dev_kfree_skb_any(wl->current_beacon);
1744         wl->current_beacon = beacon;
1745         wl->beacon0_uploaded = 0;
1746         wl->beacon1_uploaded = 0;
1747         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
1748 }
1749
1750 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
1751 {
1752         b43_time_lock(dev);
1753         if (dev->dev->core_rev >= 3) {
1754                 b43_write32(dev, B43_MMIO_TSF_CFP_REP, (beacon_int << 16));
1755                 b43_write32(dev, B43_MMIO_TSF_CFP_START, (beacon_int << 10));
1756         } else {
1757                 b43_write16(dev, 0x606, (beacon_int >> 6));
1758                 b43_write16(dev, 0x610, beacon_int);
1759         }
1760         b43_time_unlock(dev);
1761         b43dbg(dev->wl, "Set beacon interval to %u\n", beacon_int);
1762 }
1763
1764 static void b43_handle_firmware_panic(struct b43_wldev *dev)
1765 {
1766         u16 reason;
1767
1768         /* Read the register that contains the reason code for the panic. */
1769         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_FWPANIC_REASON_REG);
1770         b43err(dev->wl, "Whoopsy, firmware panic! Reason: %u\n", reason);
1771
1772         switch (reason) {
1773         default:
1774                 b43dbg(dev->wl, "The panic reason is unknown.\n");
1775                 /* fallthrough */
1776         case B43_FWPANIC_DIE:
1777                 /* Do not restart the controller or firmware.
1778                  * The device is nonfunctional from now on.
1779                  * Restarting would result in this panic to trigger again,
1780                  * so we avoid that recursion. */
1781                 break;
1782         case B43_FWPANIC_RESTART:
1783                 b43_controller_restart(dev, "Microcode panic");
1784                 break;
1785         }
1786 }
1787
1788 static void handle_irq_ucode_debug(struct b43_wldev *dev)
1789 {
1790         unsigned int i, cnt;
1791         u16 reason, marker_id, marker_line;
1792         __le16 *buf;
1793
1794         /* The proprietary firmware doesn't have this IRQ. */
1795         if (!dev->fw.opensource)
1796                 return;
1797
1798         /* Read the register that contains the reason code for this IRQ. */
1799         reason = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_DEBUGIRQ_REASON_REG);
1800
1801         switch (reason) {
1802         case B43_DEBUGIRQ_PANIC:
1803                 b43_handle_firmware_panic(dev);
1804                 break;
1805         case B43_DEBUGIRQ_DUMP_SHM:
1806                 if (!B43_DEBUG)
1807                         break; /* Only with driver debugging enabled. */
1808                 buf = kmalloc(4096, GFP_ATOMIC);
1809                 if (!buf) {
1810                         b43dbg(dev->wl, "SHM-dump: Failed to allocate memory\n");
1811                         goto out;
1812                 }
1813                 for (i = 0; i < 4096; i += 2) {
1814                         u16 tmp = b43_shm_read16(dev, B43_SHM_SHARED, i);
1815                         buf[i / 2] = cpu_to_le16(tmp);
1816                 }
1817                 b43info(dev->wl, "Shared memory dump:\n");
1818                 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET,
1819                                16, 2, buf, 4096, 1);
1820                 kfree(buf);
1821                 break;
1822         case B43_DEBUGIRQ_DUMP_REGS:
1823                 if (!B43_DEBUG)
1824                         break; /* Only with driver debugging enabled. */
1825                 b43info(dev->wl, "Microcode register dump:\n");
1826                 for (i = 0, cnt = 0; i < 64; i++) {
1827                         u16 tmp = b43_shm_read16(dev, B43_SHM_SCRATCH, i);
1828                         if (cnt == 0)
1829                                 printk(KERN_INFO);
1830                         printk("r%02u: 0x%04X  ", i, tmp);
1831                         cnt++;
1832                         if (cnt == 6) {
1833                                 printk("\n");
1834                                 cnt = 0;
1835                         }
1836                 }
1837                 printk("\n");
1838                 break;
1839         case B43_DEBUGIRQ_MARKER:
1840                 if (!B43_DEBUG)
1841                         break; /* Only with driver debugging enabled. */
1842                 marker_id = b43_shm_read16(dev, B43_SHM_SCRATCH,
1843                                            B43_MARKER_ID_REG);
1844                 marker_line = b43_shm_read16(dev, B43_SHM_SCRATCH,
1845                                              B43_MARKER_LINE_REG);
1846                 b43info(dev->wl, "The firmware just executed the MARKER(%u) "
1847                         "at line number %u\n",
1848                         marker_id, marker_line);
1849                 break;
1850         default:
1851                 b43dbg(dev->wl, "Debug-IRQ triggered for unknown reason: %u\n",
1852                        reason);
1853         }
1854 out:
1855         /* Acknowledge the debug-IRQ, so the firmware can continue. */
1856         b43_shm_write16(dev, B43_SHM_SCRATCH,
1857                         B43_DEBUGIRQ_REASON_REG, B43_DEBUGIRQ_ACK);
1858 }
1859
1860 static void b43_do_interrupt_thread(struct b43_wldev *dev)
1861 {
1862         u32 reason;
1863         u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
1864         u32 merged_dma_reason = 0;
1865         int i;
1866
1867         if (unlikely(b43_status(dev) != B43_STAT_STARTED))
1868                 return;
1869
1870         reason = dev->irq_reason;
1871         for (i = 0; i < ARRAY_SIZE(dma_reason); i++) {
1872                 dma_reason[i] = dev->dma_reason[i];
1873                 merged_dma_reason |= dma_reason[i];
1874         }
1875
1876         if (unlikely(reason & B43_IRQ_MAC_TXERR))
1877                 b43err(dev->wl, "MAC transmission error\n");
1878
1879         if (unlikely(reason & B43_IRQ_PHY_TXERR)) {
1880                 b43err(dev->wl, "PHY transmission error\n");
1881                 rmb();
1882                 if (unlikely(atomic_dec_and_test(&dev->phy.txerr_cnt))) {
1883                         atomic_set(&dev->phy.txerr_cnt,
1884                                    B43_PHY_TX_BADNESS_LIMIT);
1885                         b43err(dev->wl, "Too many PHY TX errors, "
1886                                         "restarting the controller\n");
1887                         b43_controller_restart(dev, "PHY TX errors");
1888                 }
1889         }
1890
1891         if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
1892                                           B43_DMAIRQ_NONFATALMASK))) {
1893                 if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
1894                         b43err(dev->wl, "Fatal DMA error: "
1895                                "0x%08X, 0x%08X, 0x%08X, "
1896                                "0x%08X, 0x%08X, 0x%08X\n",
1897                                dma_reason[0], dma_reason[1],
1898                                dma_reason[2], dma_reason[3],
1899                                dma_reason[4], dma_reason[5]);
1900                         b43err(dev->wl, "This device does not support DMA "
1901                                "on your system. It will now be switched to PIO.\n");
1902                         /* Fall back to PIO transfers if we get fatal DMA errors! */
1903                         dev->use_pio = 1;
1904                         b43_controller_restart(dev, "DMA error");
1905                         return;
1906                 }
1907                 if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
1908                         b43err(dev->wl, "DMA error: "
1909                                "0x%08X, 0x%08X, 0x%08X, "
1910                                "0x%08X, 0x%08X, 0x%08X\n",
1911                                dma_reason[0], dma_reason[1],
1912                                dma_reason[2], dma_reason[3],
1913                                dma_reason[4], dma_reason[5]);
1914                 }
1915         }
1916
1917         if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
1918                 handle_irq_ucode_debug(dev);
1919         if (reason & B43_IRQ_TBTT_INDI)
1920                 handle_irq_tbtt_indication(dev);
1921         if (reason & B43_IRQ_ATIM_END)
1922                 handle_irq_atim_end(dev);
1923         if (reason & B43_IRQ_BEACON)
1924                 handle_irq_beacon(dev);
1925         if (reason & B43_IRQ_PMQ)
1926                 handle_irq_pmq(dev);
1927         if (reason & B43_IRQ_TXFIFO_FLUSH_OK)
1928                 ;/* TODO */
1929         if (reason & B43_IRQ_NOISESAMPLE_OK)
1930                 handle_irq_noise(dev);
1931
1932         /* Check the DMA reason registers for received data. */
1933         if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
1934                 if (b43_using_pio_transfers(dev))
1935                         b43_pio_rx(dev->pio.rx_queue);
1936                 else
1937                         b43_dma_rx(dev->dma.rx_ring);
1938         }
1939         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
1940         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
1941         B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
1942         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
1943         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
1944
1945         if (reason & B43_IRQ_TX_OK)
1946                 handle_irq_transmit_status(dev);
1947
1948         /* Re-enable interrupts on the device by restoring the current interrupt mask. */
1949         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, dev->irq_mask);
1950
1951 #if B43_DEBUG
1952         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
1953                 dev->irq_count++;
1954                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
1955                         if (reason & (1 << i))
1956                                 dev->irq_bit_count[i]++;
1957                 }
1958         }
1959 #endif
1960 }
1961
1962 /* Interrupt thread handler. Handles device interrupts in thread context. */
1963 static irqreturn_t b43_interrupt_thread_handler(int irq, void *dev_id)
1964 {
1965         struct b43_wldev *dev = dev_id;
1966
1967         mutex_lock(&dev->wl->mutex);
1968         b43_do_interrupt_thread(dev);
1969         mmiowb();
1970         mutex_unlock(&dev->wl->mutex);
1971
1972         return IRQ_HANDLED;
1973 }
1974
1975 static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
1976 {
1977         u32 reason;
1978
1979         /* This code runs under wl->hardirq_lock, but _only_ on non-SDIO busses.
1980          * On SDIO, this runs under wl->mutex. */
1981
1982         reason = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
1983         if (reason == 0xffffffff)       /* shared IRQ */
1984                 return IRQ_NONE;
1985         reason &= dev->irq_mask;
1986         if (!reason)
1987                 return IRQ_NONE;
1988
1989         dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
1990             & 0x0001DC00;
1991         dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
1992             & 0x0000DC00;
1993         dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
1994             & 0x0000DC00;
1995         dev->dma_reason[3] = b43_read32(dev, B43_MMIO_DMA3_REASON)
1996             & 0x0001DC00;
1997         dev->dma_reason[4] = b43_read32(dev, B43_MMIO_DMA4_REASON)
1998             & 0x0000DC00;
1999 /* Unused ring
2000         dev->dma_reason[5] = b43_read32(dev, B43_MMIO_DMA5_REASON)
2001             & 0x0000DC00;
2002 */
2003
2004         /* ACK the interrupt. */
2005         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, reason);
2006         b43_write32(dev, B43_MMIO_DMA0_REASON, dev->dma_reason[0]);
2007         b43_write32(dev, B43_MMIO_DMA1_REASON, dev->dma_reason[1]);
2008         b43_write32(dev, B43_MMIO_DMA2_REASON, dev->dma_reason[2]);
2009         b43_write32(dev, B43_MMIO_DMA3_REASON, dev->dma_reason[3]);
2010         b43_write32(dev, B43_MMIO_DMA4_REASON, dev->dma_reason[4]);
2011 /* Unused ring
2012         b43_write32(dev, B43_MMIO_DMA5_REASON, dev->dma_reason[5]);
2013 */
2014
2015         /* Disable IRQs on the device. The IRQ thread handler will re-enable them. */
2016         b43_write32(dev, B43_MMIO_GEN_IRQ_MASK, 0);
2017         /* Save the reason bitmasks for the IRQ thread handler. */
2018         dev->irq_reason = reason;
2019
2020         return IRQ_WAKE_THREAD;
2021 }
2022
2023 /* Interrupt handler top-half. This runs with interrupts disabled. */
2024 static irqreturn_t b43_interrupt_handler(int irq, void *dev_id)
2025 {
2026         struct b43_wldev *dev = dev_id;
2027         irqreturn_t ret;
2028
2029         if (unlikely(b43_status(dev) < B43_STAT_STARTED))
2030                 return IRQ_NONE;
2031
2032         spin_lock(&dev->wl->hardirq_lock);
2033         ret = b43_do_interrupt(dev);
2034         mmiowb();
2035         spin_unlock(&dev->wl->hardirq_lock);
2036
2037         return ret;
2038 }
2039
2040 /* SDIO interrupt handler. This runs in process context. */
2041 static void b43_sdio_interrupt_handler(struct b43_wldev *dev)
2042 {
2043         struct b43_wl *wl = dev->wl;
2044         irqreturn_t ret;
2045
2046         mutex_lock(&wl->mutex);
2047
2048         ret = b43_do_interrupt(dev);
2049         if (ret == IRQ_WAKE_THREAD)
2050                 b43_do_interrupt_thread(dev);
2051
2052         mutex_unlock(&wl->mutex);
2053 }
2054
2055 void b43_do_release_fw(struct b43_firmware_file *fw)
2056 {
2057         release_firmware(fw->data);
2058         fw->data = NULL;
2059         fw->filename = NULL;
2060 }
2061
2062 static void b43_release_firmware(struct b43_wldev *dev)
2063 {
2064         b43_do_release_fw(&dev->fw.ucode);
2065         b43_do_release_fw(&dev->fw.pcm);
2066         b43_do_release_fw(&dev->fw.initvals);
2067         b43_do_release_fw(&dev->fw.initvals_band);
2068 }
2069
2070 static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
2071 {
2072         const char text[] =
2073                 "You must go to " \
2074                 "http://wireless.kernel.org/en/users/Drivers/b43#devicefirmware " \
2075                 "and download the correct firmware for this driver version. " \
2076                 "Please carefully read all instructions on this website.\n";
2077
2078         if (error)
2079                 b43err(wl, text);
2080         else
2081                 b43warn(wl, text);
2082 }
2083
2084 int b43_do_request_fw(struct b43_request_fw_context *ctx,
2085                       const char *name,
2086                       struct b43_firmware_file *fw)
2087 {
2088         const struct firmware *blob;
2089         struct b43_fw_header *hdr;
2090         u32 size;
2091         int err;
2092
2093         if (!name) {
2094                 /* Don't fetch anything. Free possibly cached firmware. */
2095                 /* FIXME: We should probably keep it anyway, to save some headache
2096                  * on suspend/resume with multiband devices. */
2097                 b43_do_release_fw(fw);
2098                 return 0;
2099         }
2100         if (fw->filename) {
2101                 if ((fw->type == ctx->req_type) &&
2102                     (strcmp(fw->filename, name) == 0))
2103                         return 0; /* Already have this fw. */
2104                 /* Free the cached firmware first. */
2105                 /* FIXME: We should probably do this later after we successfully
2106                  * got the new fw. This could reduce headache with multiband devices.
2107                  * We could also redesign this to cache the firmware for all possible
2108                  * bands all the time. */
2109                 b43_do_release_fw(fw);
2110         }
2111
2112         switch (ctx->req_type) {
2113         case B43_FWTYPE_PROPRIETARY:
2114                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2115                          "b43%s/%s.fw",
2116                          modparam_fwpostfix, name);
2117                 break;
2118         case B43_FWTYPE_OPENSOURCE:
2119                 snprintf(ctx->fwname, sizeof(ctx->fwname),
2120                          "b43-open%s/%s.fw",
2121                          modparam_fwpostfix, name);
2122                 break;
2123         default:
2124                 B43_WARN_ON(1);
2125                 return -ENOSYS;
2126         }
2127         err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
2128         if (err == -ENOENT) {
2129                 snprintf(ctx->errors[ctx->req_type],
2130                          sizeof(ctx->errors[ctx->req_type]),
2131                          "Firmware file \"%s\" not found\n", ctx->fwname);
2132                 return err;
2133         } else if (err) {
2134                 snprintf(ctx->errors[ctx->req_type],
2135                          sizeof(ctx->errors[ctx->req_type]),
2136                          "Firmware file \"%s\" request failed (err=%d)\n",
2137                          ctx->fwname, err);
2138                 return err;
2139         }
2140         if (blob->size < sizeof(struct b43_fw_header))
2141                 goto err_format;
2142         hdr = (struct b43_fw_header *)(blob->data);
2143         switch (hdr->type) {
2144         case B43_FW_TYPE_UCODE:
2145         case B43_FW_TYPE_PCM:
2146                 size = be32_to_cpu(hdr->size);
2147                 if (size != blob->size - sizeof(struct b43_fw_header))
2148                         goto err_format;
2149                 /* fallthrough */
2150         case B43_FW_TYPE_IV:
2151                 if (hdr->ver != 1)
2152                         goto err_format;
2153                 break;
2154         default:
2155                 goto err_format;
2156         }
2157
2158         fw->data = blob;
2159         fw->filename = name;
2160         fw->type = ctx->req_type;
2161
2162         return 0;
2163
2164 err_format:
2165         snprintf(ctx->errors[ctx->req_type],
2166                  sizeof(ctx->errors[ctx->req_type]),
2167                  "Firmware file \"%s\" format error.\n", ctx->fwname);
2168         release_firmware(blob);
2169
2170         return -EPROTO;
2171 }
2172
2173 static int b43_try_request_fw(struct b43_request_fw_context *ctx)
2174 {
2175         struct b43_wldev *dev = ctx->dev;
2176         struct b43_firmware *fw = &ctx->dev->fw;
2177         const u8 rev = ctx->dev->dev->core_rev;
2178         const char *filename;
2179         u32 tmshigh;
2180         int err;
2181
2182         /* Files for HT and LCN were found by trying one by one */
2183
2184         /* Get microcode */
2185         if ((rev >= 5) && (rev <= 10)) {
2186                 filename = "ucode5";
2187         } else if ((rev >= 11) && (rev <= 12)) {
2188                 filename = "ucode11";
2189         } else if (rev == 13) {
2190                 filename = "ucode13";
2191         } else if (rev == 14) {
2192                 filename = "ucode14";
2193         } else if (rev == 15) {
2194                 filename = "ucode15";
2195         } else {
2196                 switch (dev->phy.type) {
2197                 case B43_PHYTYPE_N:
2198                         if (rev >= 16)
2199                                 filename = "ucode16_mimo";
2200                         else
2201                                 goto err_no_ucode;
2202                         break;
2203                 case B43_PHYTYPE_HT:
2204                         if (rev == 29)
2205                                 filename = "ucode29_mimo";
2206                         else
2207                                 goto err_no_ucode;
2208                         break;
2209                 case B43_PHYTYPE_LCN:
2210                         if (rev == 24)
2211                                 filename = "ucode24_mimo";
2212                         else
2213                                 goto err_no_ucode;
2214                         break;
2215                 default:
2216                         goto err_no_ucode;
2217                 }
2218         }
2219         err = b43_do_request_fw(ctx, filename, &fw->ucode);
2220         if (err)
2221                 goto err_load;
2222
2223         /* Get PCM code */
2224         if ((rev >= 5) && (rev <= 10))
2225                 filename = "pcm5";
2226         else if (rev >= 11)
2227                 filename = NULL;
2228         else
2229                 goto err_no_pcm;
2230         fw->pcm_request_failed = 0;
2231         err = b43_do_request_fw(ctx, filename, &fw->pcm);
2232         if (err == -ENOENT) {
2233                 /* We did not find a PCM file? Not fatal, but
2234                  * core rev <= 10 must do without hwcrypto then. */
2235                 fw->pcm_request_failed = 1;
2236         } else if (err)
2237                 goto err_load;
2238
2239         /* Get initvals */
2240         switch (dev->phy.type) {
2241         case B43_PHYTYPE_A:
2242                 if ((rev >= 5) && (rev <= 10)) {
2243                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2244                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2245                                 filename = "a0g1initvals5";
2246                         else
2247                                 filename = "a0g0initvals5";
2248                 } else
2249                         goto err_no_initvals;
2250                 break;
2251         case B43_PHYTYPE_G:
2252                 if ((rev >= 5) && (rev <= 10))
2253                         filename = "b0g0initvals5";
2254                 else if (rev >= 13)
2255                         filename = "b0g0initvals13";
2256                 else
2257                         goto err_no_initvals;
2258                 break;
2259         case B43_PHYTYPE_N:
2260                 if (rev >= 16)
2261                         filename = "n0initvals16";
2262                 else if ((rev >= 11) && (rev <= 12))
2263                         filename = "n0initvals11";
2264                 else
2265                         goto err_no_initvals;
2266                 break;
2267         case B43_PHYTYPE_LP:
2268                 if (rev == 13)
2269                         filename = "lp0initvals13";
2270                 else if (rev == 14)
2271                         filename = "lp0initvals14";
2272                 else if (rev >= 15)
2273                         filename = "lp0initvals15";
2274                 else
2275                         goto err_no_initvals;
2276                 break;
2277         case B43_PHYTYPE_HT:
2278                 if (rev == 29)
2279                         filename = "ht0initvals29";
2280                 else
2281                         goto err_no_initvals;
2282                 break;
2283         case B43_PHYTYPE_LCN:
2284                 if (rev == 24)
2285                         filename = "lcn0initvals24";
2286                 else
2287                         goto err_no_initvals;
2288                 break;
2289         default:
2290                 goto err_no_initvals;
2291         }
2292         err = b43_do_request_fw(ctx, filename, &fw->initvals);
2293         if (err)
2294                 goto err_load;
2295
2296         /* Get bandswitch initvals */
2297         switch (dev->phy.type) {
2298         case B43_PHYTYPE_A:
2299                 if ((rev >= 5) && (rev <= 10)) {
2300                         tmshigh = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
2301                         if (tmshigh & B43_TMSHIGH_HAVE_2GHZ_PHY)
2302                                 filename = "a0g1bsinitvals5";
2303                         else
2304                                 filename = "a0g0bsinitvals5";
2305                 } else if (rev >= 11)
2306                         filename = NULL;
2307                 else
2308                         goto err_no_initvals;
2309                 break;
2310         case B43_PHYTYPE_G:
2311                 if ((rev >= 5) && (rev <= 10))
2312                         filename = "b0g0bsinitvals5";
2313                 else if (rev >= 11)
2314                         filename = NULL;
2315                 else
2316                         goto err_no_initvals;
2317                 break;
2318         case B43_PHYTYPE_N:
2319                 if (rev >= 16)
2320                         filename = "n0bsinitvals16";
2321                 else if ((rev >= 11) && (rev <= 12))
2322                         filename = "n0bsinitvals11";
2323                 else
2324                         goto err_no_initvals;
2325                 break;
2326         case B43_PHYTYPE_LP:
2327                 if (rev == 13)
2328                         filename = "lp0bsinitvals13";
2329                 else if (rev == 14)
2330                         filename = "lp0bsinitvals14";
2331                 else if (rev >= 15)
2332                         filename = "lp0bsinitvals15";
2333                 else
2334                         goto err_no_initvals;
2335                 break;
2336         case B43_PHYTYPE_HT:
2337                 if (rev == 29)
2338                         filename = "ht0bsinitvals29";
2339                 else
2340                         goto err_no_initvals;
2341                 break;
2342         case B43_PHYTYPE_LCN:
2343                 if (rev == 24)
2344                         filename = "lcn0bsinitvals24";
2345                 else
2346                         goto err_no_initvals;
2347                 break;
2348         default:
2349                 goto err_no_initvals;
2350         }
2351         err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
2352         if (err)
2353                 goto err_load;
2354
2355         return 0;
2356
2357 err_no_ucode:
2358         err = ctx->fatal_failure = -EOPNOTSUPP;
2359         b43err(dev->wl, "The driver does not know which firmware (ucode) "
2360                "is required for your device (wl-core rev %u)\n", rev);
2361         goto error;
2362
2363 err_no_pcm:
2364         err = ctx->fatal_failure = -EOPNOTSUPP;
2365         b43err(dev->wl, "The driver does not know which firmware (PCM) "
2366                "is required for your device (wl-core rev %u)\n", rev);
2367         goto error;
2368
2369 err_no_initvals:
2370         err = ctx->fatal_failure = -EOPNOTSUPP;
2371         b43err(dev->wl, "The driver does not know which firmware (initvals) "
2372                "is required for your device (wl-core rev %u)\n", rev);
2373         goto error;
2374
2375 err_load:
2376         /* We failed to load this firmware image. The error message
2377          * already is in ctx->errors. Return and let our caller decide
2378          * what to do. */
2379         goto error;
2380
2381 error:
2382         b43_release_firmware(dev);
2383         return err;
2384 }
2385
2386 static int b43_request_firmware(struct b43_wldev *dev)
2387 {
2388         struct b43_request_fw_context *ctx;
2389         unsigned int i;
2390         int err;
2391         const char *errmsg;
2392
2393         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2394         if (!ctx)
2395                 return -ENOMEM;
2396         ctx->dev = dev;
2397
2398         ctx->req_type = B43_FWTYPE_PROPRIETARY;
2399         err = b43_try_request_fw(ctx);
2400         if (!err)
2401                 goto out; /* Successfully loaded it. */
2402         err = ctx->fatal_failure;
2403         if (err)
2404                 goto out;
2405
2406         ctx->req_type = B43_FWTYPE_OPENSOURCE;
2407         err = b43_try_request_fw(ctx);
2408         if (!err)
2409                 goto out; /* Successfully loaded it. */
2410         err = ctx->fatal_failure;
2411         if (err)
2412                 goto out;
2413
2414         /* Could not find a usable firmware. Print the errors. */
2415         for (i = 0; i < B43_NR_FWTYPES; i++) {
2416                 errmsg = ctx->errors[i];
2417                 if (strlen(errmsg))
2418                         b43err(dev->wl, errmsg);
2419         }
2420         b43_print_fw_helptext(dev->wl, 1);
2421         err = -ENOENT;
2422
2423 out:
2424         kfree(ctx);
2425         return err;
2426 }
2427
2428 static int b43_upload_microcode(struct b43_wldev *dev)
2429 {
2430         struct wiphy *wiphy = dev->wl->hw->wiphy;
2431         const size_t hdr_len = sizeof(struct b43_fw_header);
2432         const __be32 *data;
2433         unsigned int i, len;
2434         u16 fwrev, fwpatch, fwdate, fwtime;
2435         u32 tmp, macctl;
2436         int err = 0;
2437
2438         /* Jump the microcode PSM to offset 0 */
2439         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2440         B43_WARN_ON(macctl & B43_MACCTL_PSM_RUN);
2441         macctl |= B43_MACCTL_PSM_JMP0;
2442         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2443         /* Zero out all microcode PSM registers and shared memory. */
2444         for (i = 0; i < 64; i++)
2445                 b43_shm_write16(dev, B43_SHM_SCRATCH, i, 0);
2446         for (i = 0; i < 4096; i += 2)
2447                 b43_shm_write16(dev, B43_SHM_SHARED, i, 0);
2448
2449         /* Upload Microcode. */
2450         data = (__be32 *) (dev->fw.ucode.data->data + hdr_len);
2451         len = (dev->fw.ucode.data->size - hdr_len) / sizeof(__be32);
2452         b43_shm_control_word(dev, B43_SHM_UCODE | B43_SHM_AUTOINC_W, 0x0000);
2453         for (i = 0; i < len; i++) {
2454                 b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2455                 udelay(10);
2456         }
2457
2458         if (dev->fw.pcm.data) {
2459                 /* Upload PCM data. */
2460                 data = (__be32 *) (dev->fw.pcm.data->data + hdr_len);
2461                 len = (dev->fw.pcm.data->size - hdr_len) / sizeof(__be32);
2462                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EA);
2463                 b43_write32(dev, B43_MMIO_SHM_DATA, 0x00004000);
2464                 /* No need for autoinc bit in SHM_HW */
2465                 b43_shm_control_word(dev, B43_SHM_HW, 0x01EB);
2466                 for (i = 0; i < len; i++) {
2467                         b43_write32(dev, B43_MMIO_SHM_DATA, be32_to_cpu(data[i]));
2468                         udelay(10);
2469                 }
2470         }
2471
2472         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, B43_IRQ_ALL);
2473
2474         /* Start the microcode PSM */
2475         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2476         macctl &= ~B43_MACCTL_PSM_JMP0;
2477         macctl |= B43_MACCTL_PSM_RUN;
2478         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2479
2480         /* Wait for the microcode to load and respond */
2481         i = 0;
2482         while (1) {
2483                 tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2484                 if (tmp == B43_IRQ_MAC_SUSPENDED)
2485                         break;
2486                 i++;
2487                 if (i >= 20) {
2488                         b43err(dev->wl, "Microcode not responding\n");
2489                         b43_print_fw_helptext(dev->wl, 1);
2490                         err = -ENODEV;
2491                         goto error;
2492                 }
2493                 msleep(50);
2494         }
2495         b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);       /* dummy read */
2496
2497         /* Get and check the revisions. */
2498         fwrev = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEREV);
2499         fwpatch = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEPATCH);
2500         fwdate = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODEDATE);
2501         fwtime = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_UCODETIME);
2502
2503         if (fwrev <= 0x128) {
2504                 b43err(dev->wl, "YOUR FIRMWARE IS TOO OLD. Firmware from "
2505                        "binary drivers older than version 4.x is unsupported. "
2506                        "You must upgrade your firmware files.\n");
2507                 b43_print_fw_helptext(dev->wl, 1);
2508                 err = -EOPNOTSUPP;
2509                 goto error;
2510         }
2511         dev->fw.rev = fwrev;
2512         dev->fw.patch = fwpatch;
2513         dev->fw.opensource = (fwdate == 0xFFFF);
2514
2515         /* Default to use-all-queues. */
2516         dev->wl->hw->queues = dev->wl->mac80211_initially_registered_queues;
2517         dev->qos_enabled = !!modparam_qos;
2518         /* Default to firmware/hardware crypto acceleration. */
2519         dev->hwcrypto_enabled = 1;
2520
2521         if (dev->fw.opensource) {
2522                 u16 fwcapa;
2523
2524                 /* Patchlevel info is encoded in the "time" field. */
2525                 dev->fw.patch = fwtime;
2526                 b43info(dev->wl, "Loading OpenSource firmware version %u.%u\n",
2527                         dev->fw.rev, dev->fw.patch);
2528
2529                 fwcapa = b43_fwcapa_read(dev);
2530                 if (!(fwcapa & B43_FWCAPA_HWCRYPTO) || dev->fw.pcm_request_failed) {
2531                         b43info(dev->wl, "Hardware crypto acceleration not supported by firmware\n");
2532                         /* Disable hardware crypto and fall back to software crypto. */
2533                         dev->hwcrypto_enabled = 0;
2534                 }
2535                 if (!(fwcapa & B43_FWCAPA_QOS)) {
2536                         b43info(dev->wl, "QoS not supported by firmware\n");
2537                         /* Disable QoS. Tweak hw->queues to 1. It will be restored before
2538                          * ieee80211_unregister to make sure the networking core can
2539                          * properly free possible resources. */
2540                         dev->wl->hw->queues = 1;
2541                         dev->qos_enabled = 0;
2542                 }
2543         } else {
2544                 b43info(dev->wl, "Loading firmware version %u.%u "
2545                         "(20%.2i-%.2i-%.2i %.2i:%.2i:%.2i)\n",
2546                         fwrev, fwpatch,
2547                         (fwdate >> 12) & 0xF, (fwdate >> 8) & 0xF, fwdate & 0xFF,
2548                         (fwtime >> 11) & 0x1F, (fwtime >> 5) & 0x3F, fwtime & 0x1F);
2549                 if (dev->fw.pcm_request_failed) {
2550                         b43warn(dev->wl, "No \"pcm5.fw\" firmware file found. "
2551                                 "Hardware accelerated cryptography is disabled.\n");
2552                         b43_print_fw_helptext(dev->wl, 0);
2553                 }
2554         }
2555
2556         snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "%u.%u",
2557                         dev->fw.rev, dev->fw.patch);
2558         wiphy->hw_version = dev->dev->core_id;
2559
2560         if (b43_is_old_txhdr_format(dev)) {
2561                 /* We're over the deadline, but we keep support for old fw
2562                  * until it turns out to be in major conflict with something new. */
2563                 b43warn(dev->wl, "You are using an old firmware image. "
2564                         "Support for old firmware will be removed soon "
2565                         "(official deadline was July 2008).\n");
2566                 b43_print_fw_helptext(dev->wl, 0);
2567         }
2568
2569         return 0;
2570
2571 error:
2572         macctl = b43_read32(dev, B43_MMIO_MACCTL);
2573         macctl &= ~B43_MACCTL_PSM_RUN;
2574         macctl |= B43_MACCTL_PSM_JMP0;
2575         b43_write32(dev, B43_MMIO_MACCTL, macctl);
2576
2577         return err;
2578 }
2579
2580 static int b43_write_initvals(struct b43_wldev *dev,
2581                               const struct b43_iv *ivals,
2582                               size_t count,
2583                               size_t array_size)
2584 {
2585         const struct b43_iv *iv;
2586         u16 offset;
2587         size_t i;
2588         bool bit32;
2589
2590         BUILD_BUG_ON(sizeof(struct b43_iv) != 6);
2591         iv = ivals;
2592         for (i = 0; i < count; i++) {
2593                 if (array_size < sizeof(iv->offset_size))
2594                         goto err_format;
2595                 array_size -= sizeof(iv->offset_size);
2596                 offset = be16_to_cpu(iv->offset_size);
2597                 bit32 = !!(offset & B43_IV_32BIT);
2598                 offset &= B43_IV_OFFSET_MASK;
2599                 if (offset >= 0x1000)
2600                         goto err_format;
2601                 if (bit32) {
2602                         u32 value;
2603
2604                         if (array_size < sizeof(iv->data.d32))
2605                                 goto err_format;
2606                         array_size -= sizeof(iv->data.d32);
2607
2608                         value = get_unaligned_be32(&iv->data.d32);
2609                         b43_write32(dev, offset, value);
2610
2611                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2612                                                         sizeof(__be16) +
2613                                                         sizeof(__be32));
2614                 } else {
2615                         u16 value;
2616
2617                         if (array_size < sizeof(iv->data.d16))
2618                                 goto err_format;
2619                         array_size -= sizeof(iv->data.d16);
2620
2621                         value = be16_to_cpu(iv->data.d16);
2622                         b43_write16(dev, offset, value);
2623
2624                         iv = (const struct b43_iv *)((const uint8_t *)iv +
2625                                                         sizeof(__be16) +
2626                                                         sizeof(__be16));
2627                 }
2628         }
2629         if (array_size)
2630                 goto err_format;
2631
2632         return 0;
2633
2634 err_format:
2635         b43err(dev->wl, "Initial Values Firmware file-format error.\n");
2636         b43_print_fw_helptext(dev->wl, 1);
2637
2638         return -EPROTO;
2639 }
2640
2641 static int b43_upload_initvals(struct b43_wldev *dev)
2642 {
2643         const size_t hdr_len = sizeof(struct b43_fw_header);
2644         const struct b43_fw_header *hdr;
2645         struct b43_firmware *fw = &dev->fw;
2646         const struct b43_iv *ivals;
2647         size_t count;
2648         int err;
2649
2650         hdr = (const struct b43_fw_header *)(fw->initvals.data->data);
2651         ivals = (const struct b43_iv *)(fw->initvals.data->data + hdr_len);
2652         count = be32_to_cpu(hdr->size);
2653         err = b43_write_initvals(dev, ivals, count,
2654                                  fw->initvals.data->size - hdr_len);
2655         if (err)
2656                 goto out;
2657         if (fw->initvals_band.data) {
2658                 hdr = (const struct b43_fw_header *)(fw->initvals_band.data->data);
2659                 ivals = (const struct b43_iv *)(fw->initvals_band.data->data + hdr_len);
2660                 count = be32_to_cpu(hdr->size);
2661                 err = b43_write_initvals(dev, ivals, count,
2662                                          fw->initvals_band.data->size - hdr_len);
2663                 if (err)
2664                         goto out;
2665         }
2666 out:
2667
2668         return err;
2669 }
2670
2671 /* Initialize the GPIOs
2672  * http://bcm-specs.sipsolutions.net/GPIO
2673  */
2674 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
2675 {
2676         struct ssb_bus *bus = dev->dev->sdev->bus;
2677
2678 #ifdef CONFIG_SSB_DRIVER_PCICORE
2679         return (bus->chipco.dev ? bus->chipco.dev : bus->pcicore.dev);
2680 #else
2681         return bus->chipco.dev;
2682 #endif
2683 }
2684
2685 static int b43_gpio_init(struct b43_wldev *dev)
2686 {
2687         struct ssb_device *gpiodev;
2688         u32 mask, set;
2689
2690         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
2691                     & ~B43_MACCTL_GPOUTSMSK);
2692
2693         b43_write16(dev, B43_MMIO_GPIO_MASK, b43_read16(dev, B43_MMIO_GPIO_MASK)
2694                     | 0x000F);
2695
2696         mask = 0x0000001F;
2697         set = 0x0000000F;
2698         if (dev->dev->chip_id == 0x4301) {
2699                 mask |= 0x0060;
2700                 set |= 0x0060;
2701         }
2702         if (0 /* FIXME: conditional unknown */ ) {
2703                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2704                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2705                             | 0x0100);
2706                 mask |= 0x0180;
2707                 set |= 0x0180;
2708         }
2709         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
2710                 b43_write16(dev, B43_MMIO_GPIO_MASK,
2711                             b43_read16(dev, B43_MMIO_GPIO_MASK)
2712                             | 0x0200);
2713                 mask |= 0x0200;
2714                 set |= 0x0200;
2715         }
2716         if (dev->dev->core_rev >= 2)
2717                 mask |= 0x0010; /* FIXME: This is redundant. */
2718
2719         switch (dev->dev->bus_type) {
2720 #ifdef CONFIG_B43_BCMA
2721         case B43_BUS_BCMA:
2722                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2723                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
2724                                         BCMA_CC_GPIOCTL) & mask) | set);
2725                 break;
2726 #endif
2727 #ifdef CONFIG_B43_SSB
2728         case B43_BUS_SSB:
2729                 gpiodev = b43_ssb_gpio_dev(dev);
2730                 if (gpiodev)
2731                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
2732                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
2733                                     & mask) | set);
2734                 break;
2735 #endif
2736         }
2737
2738         return 0;
2739 }
2740
2741 /* Turn off all GPIO stuff. Call this on module unload, for example. */
2742 static void b43_gpio_cleanup(struct b43_wldev *dev)
2743 {
2744         struct ssb_device *gpiodev;
2745
2746         switch (dev->dev->bus_type) {
2747 #ifdef CONFIG_B43_BCMA
2748         case B43_BUS_BCMA:
2749                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
2750                                 0);
2751                 break;
2752 #endif
2753 #ifdef CONFIG_B43_SSB
2754         case B43_BUS_SSB:
2755                 gpiodev = b43_ssb_gpio_dev(dev);
2756                 if (gpiodev)
2757                         ssb_write32(gpiodev, B43_GPIO_CONTROL, 0);
2758                 break;
2759 #endif
2760         }
2761 }
2762
2763 /* http://bcm-specs.sipsolutions.net/EnableMac */
2764 void b43_mac_enable(struct b43_wldev *dev)
2765 {
2766         if (b43_debug(dev, B43_DBG_FIRMWARE)) {
2767                 u16 fwstate;
2768
2769                 fwstate = b43_shm_read16(dev, B43_SHM_SHARED,
2770                                          B43_SHM_SH_UCODESTAT);
2771                 if ((fwstate != B43_SHM_SH_UCODESTAT_SUSP) &&
2772                     (fwstate != B43_SHM_SH_UCODESTAT_SLEEP)) {
2773                         b43err(dev->wl, "b43_mac_enable(): The firmware "
2774                                "should be suspended, but current state is %u\n",
2775                                fwstate);
2776                 }
2777         }
2778
2779         dev->mac_suspended--;
2780         B43_WARN_ON(dev->mac_suspended < 0);
2781         if (dev->mac_suspended == 0) {
2782                 b43_write32(dev, B43_MMIO_MACCTL,
2783                             b43_read32(dev, B43_MMIO_MACCTL)
2784                             | B43_MACCTL_ENABLED);
2785                 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON,
2786                             B43_IRQ_MAC_SUSPENDED);
2787                 /* Commit writes */
2788                 b43_read32(dev, B43_MMIO_MACCTL);
2789                 b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2790                 b43_power_saving_ctl_bits(dev, 0);
2791         }
2792 }
2793
2794 /* http://bcm-specs.sipsolutions.net/SuspendMAC */
2795 void b43_mac_suspend(struct b43_wldev *dev)
2796 {
2797         int i;
2798         u32 tmp;
2799
2800         might_sleep();
2801         B43_WARN_ON(dev->mac_suspended < 0);
2802
2803         if (dev->mac_suspended == 0) {
2804                 b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
2805                 b43_write32(dev, B43_MMIO_MACCTL,
2806                             b43_read32(dev, B43_MMIO_MACCTL)
2807                             & ~B43_MACCTL_ENABLED);
2808                 /* force pci to flush the write */
2809                 b43_read32(dev, B43_MMIO_MACCTL);
2810                 for (i = 35; i; i--) {
2811                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2812                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2813                                 goto out;
2814                         udelay(10);
2815                 }
2816                 /* Hm, it seems this will take some time. Use msleep(). */
2817                 for (i = 40; i; i--) {
2818                         tmp = b43_read32(dev, B43_MMIO_GEN_IRQ_REASON);
2819                         if (tmp & B43_IRQ_MAC_SUSPENDED)
2820                                 goto out;
2821                         msleep(1);
2822                 }
2823                 b43err(dev->wl, "MAC suspend failed\n");
2824         }
2825 out:
2826         dev->mac_suspended++;
2827 }
2828
2829 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/MacPhyClkSet */
2830 void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on)
2831 {
2832         u32 tmp;
2833
2834         switch (dev->dev->bus_type) {
2835 #ifdef CONFIG_B43_BCMA
2836         case B43_BUS_BCMA:
2837                 tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
2838                 if (on)
2839                         tmp |= B43_BCMA_IOCTL_MACPHYCLKEN;
2840                 else
2841                         tmp &= ~B43_BCMA_IOCTL_MACPHYCLKEN;
2842                 bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
2843                 break;
2844 #endif
2845 #ifdef CONFIG_B43_SSB
2846         case B43_BUS_SSB:
2847                 tmp = ssb_read32(dev->dev->sdev, SSB_TMSLOW);
2848                 if (on)
2849                         tmp |= B43_TMSLOW_MACPHYCLKEN;
2850                 else
2851                         tmp &= ~B43_TMSLOW_MACPHYCLKEN;
2852                 ssb_write32(dev->dev->sdev, SSB_TMSLOW, tmp);
2853                 break;
2854 #endif
2855         }
2856 }
2857
2858 static void b43_adjust_opmode(struct b43_wldev *dev)
2859 {
2860         struct b43_wl *wl = dev->wl;
2861         u32 ctl;
2862         u16 cfp_pretbtt;
2863
2864         ctl = b43_read32(dev, B43_MMIO_MACCTL);
2865         /* Reset status to STA infrastructure mode. */
2866         ctl &= ~B43_MACCTL_AP;
2867         ctl &= ~B43_MACCTL_KEEP_CTL;
2868         ctl &= ~B43_MACCTL_KEEP_BADPLCP;
2869         ctl &= ~B43_MACCTL_KEEP_BAD;
2870         ctl &= ~B43_MACCTL_PROMISC;
2871         ctl &= ~B43_MACCTL_BEACPROMISC;
2872         ctl |= B43_MACCTL_INFRA;
2873
2874         if (b43_is_mode(wl, NL80211_IFTYPE_AP) ||
2875             b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
2876                 ctl |= B43_MACCTL_AP;
2877         else if (b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
2878                 ctl &= ~B43_MACCTL_INFRA;
2879
2880         if (wl->filter_flags & FIF_CONTROL)
2881                 ctl |= B43_MACCTL_KEEP_CTL;
2882         if (wl->filter_flags & FIF_FCSFAIL)
2883                 ctl |= B43_MACCTL_KEEP_BAD;
2884         if (wl->filter_flags & FIF_PLCPFAIL)
2885                 ctl |= B43_MACCTL_KEEP_BADPLCP;
2886         if (wl->filter_flags & FIF_PROMISC_IN_BSS)
2887                 ctl |= B43_MACCTL_PROMISC;
2888         if (wl->filter_flags & FIF_BCN_PRBRESP_PROMISC)
2889                 ctl |= B43_MACCTL_BEACPROMISC;
2890
2891         /* Workaround: On old hardware the HW-MAC-address-filter
2892          * doesn't work properly, so always run promisc in filter
2893          * it in software. */
2894         if (dev->dev->core_rev <= 4)
2895                 ctl |= B43_MACCTL_PROMISC;
2896
2897         b43_write32(dev, B43_MMIO_MACCTL, ctl);
2898
2899         cfp_pretbtt = 2;
2900         if ((ctl & B43_MACCTL_INFRA) && !(ctl & B43_MACCTL_AP)) {
2901                 if (dev->dev->chip_id == 0x4306 &&
2902                     dev->dev->chip_rev == 3)
2903                         cfp_pretbtt = 100;
2904                 else
2905                         cfp_pretbtt = 50;
2906         }
2907         b43_write16(dev, 0x612, cfp_pretbtt);
2908
2909         /* FIXME: We don't currently implement the PMQ mechanism,
2910          *        so always disable it. If we want to implement PMQ,
2911          *        we need to enable it here (clear DISCPMQ) in AP mode.
2912          */
2913         if (0  /* ctl & B43_MACCTL_AP */) {
2914                 b43_write32(dev, B43_MMIO_MACCTL,
2915                             b43_read32(dev, B43_MMIO_MACCTL)
2916                             & ~B43_MACCTL_DISCPMQ);
2917         } else {
2918                 b43_write32(dev, B43_MMIO_MACCTL,
2919                             b43_read32(dev, B43_MMIO_MACCTL)
2920                             | B43_MACCTL_DISCPMQ);
2921         }
2922 }
2923
2924 static void b43_rate_memory_write(struct b43_wldev *dev, u16 rate, int is_ofdm)
2925 {
2926         u16 offset;
2927
2928         if (is_ofdm) {
2929                 offset = 0x480;
2930                 offset += (b43_plcp_get_ratecode_ofdm(rate) & 0x000F) * 2;
2931         } else {
2932                 offset = 0x4C0;
2933                 offset += (b43_plcp_get_ratecode_cck(rate) & 0x000F) * 2;
2934         }
2935         b43_shm_write16(dev, B43_SHM_SHARED, offset + 0x20,
2936                         b43_shm_read16(dev, B43_SHM_SHARED, offset));
2937 }
2938
2939 static void b43_rate_memory_init(struct b43_wldev *dev)
2940 {
2941         switch (dev->phy.type) {
2942         case B43_PHYTYPE_A:
2943         case B43_PHYTYPE_G:
2944         case B43_PHYTYPE_N:
2945         case B43_PHYTYPE_LP:
2946                 b43_rate_memory_write(dev, B43_OFDM_RATE_6MB, 1);
2947                 b43_rate_memory_write(dev, B43_OFDM_RATE_12MB, 1);
2948                 b43_rate_memory_write(dev, B43_OFDM_RATE_18MB, 1);
2949                 b43_rate_memory_write(dev, B43_OFDM_RATE_24MB, 1);
2950                 b43_rate_memory_write(dev, B43_OFDM_RATE_36MB, 1);
2951                 b43_rate_memory_write(dev, B43_OFDM_RATE_48MB, 1);
2952                 b43_rate_memory_write(dev, B43_OFDM_RATE_54MB, 1);
2953                 if (dev->phy.type == B43_PHYTYPE_A)
2954                         break;
2955                 /* fallthrough */
2956         case B43_PHYTYPE_B:
2957                 b43_rate_memory_write(dev, B43_CCK_RATE_1MB, 0);
2958                 b43_rate_memory_write(dev, B43_CCK_RATE_2MB, 0);
2959                 b43_rate_memory_write(dev, B43_CCK_RATE_5MB, 0);
2960                 b43_rate_memory_write(dev, B43_CCK_RATE_11MB, 0);
2961                 break;
2962         default:
2963                 B43_WARN_ON(1);
2964         }
2965 }
2966
2967 /* Set the default values for the PHY TX Control Words. */
2968 static void b43_set_phytxctl_defaults(struct b43_wldev *dev)
2969 {
2970         u16 ctl = 0;
2971
2972         ctl |= B43_TXH_PHY_ENC_CCK;
2973         ctl |= B43_TXH_PHY_ANT01AUTO;
2974         ctl |= B43_TXH_PHY_TXPWR;
2975
2976         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_BEACPHYCTL, ctl);
2977         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, ctl);
2978         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, ctl);
2979 }
2980
2981 /* Set the TX-Antenna for management frames sent by firmware. */
2982 static void b43_mgmtframe_txantenna(struct b43_wldev *dev, int antenna)
2983 {
2984         u16 ant;
2985         u16 tmp;
2986
2987         ant = b43_antenna_to_phyctl(antenna);
2988
2989         /* For ACK/CTS */
2990         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL);
2991         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2992         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_ACKCTSPHYCTL, tmp);
2993         /* For Probe Resposes */
2994         tmp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL);
2995         tmp = (tmp & ~B43_TXH_PHY_ANT) | ant;
2996         b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_PRPHYCTL, tmp);
2997 }
2998
2999 /* This is the opposite of b43_chip_init() */
3000 static void b43_chip_exit(struct b43_wldev *dev)
3001 {
3002         b43_phy_exit(dev);
3003         b43_gpio_cleanup(dev);
3004         /* firmware is released later */
3005 }
3006
3007 /* Initialize the chip
3008  * http://bcm-specs.sipsolutions.net/ChipInit
3009  */
3010 static int b43_chip_init(struct b43_wldev *dev)
3011 {
3012         struct b43_phy *phy = &dev->phy;
3013         int err;
3014         u32 macctl;
3015         u16 value16;
3016
3017         /* Initialize the MAC control */
3018         macctl = B43_MACCTL_IHR_ENABLED | B43_MACCTL_SHM_ENABLED;
3019         if (dev->phy.gmode)
3020                 macctl |= B43_MACCTL_GMODE;
3021         macctl |= B43_MACCTL_INFRA;
3022         b43_write32(dev, B43_MMIO_MACCTL, macctl);
3023
3024         err = b43_request_firmware(dev);
3025         if (err)
3026                 goto out;
3027         err = b43_upload_microcode(dev);
3028         if (err)
3029                 goto out;       /* firmware is released later */
3030
3031         err = b43_gpio_init(dev);
3032         if (err)
3033                 goto out;       /* firmware is released later */
3034
3035         err = b43_upload_initvals(dev);
3036         if (err)
3037                 goto err_gpio_clean;
3038
3039         /* Turn the Analog on and initialize the PHY. */
3040         phy->ops->switch_analog(dev, 1);
3041         err = b43_phy_init(dev);
3042         if (err)
3043                 goto err_gpio_clean;
3044
3045         /* Disable Interference Mitigation. */
3046         if (phy->ops->interf_mitigation)
3047                 phy->ops->interf_mitigation(dev, B43_INTERFMODE_NONE);
3048
3049         /* Select the antennae */
3050         if (phy->ops->set_rx_antenna)
3051                 phy->ops->set_rx_antenna(dev, B43_ANTENNA_DEFAULT);
3052         b43_mgmtframe_txantenna(dev, B43_ANTENNA_DEFAULT);
3053
3054         if (phy->type == B43_PHYTYPE_B) {
3055                 value16 = b43_read16(dev, 0x005E);
3056                 value16 |= 0x0004;
3057                 b43_write16(dev, 0x005E, value16);
3058         }
3059         b43_write32(dev, 0x0100, 0x01000000);
3060         if (dev->dev->core_rev < 5)
3061                 b43_write32(dev, 0x010C, 0x01000000);
3062
3063         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3064                     & ~B43_MACCTL_INFRA);
3065         b43_write32(dev, B43_MMIO_MACCTL, b43_read32(dev, B43_MMIO_MACCTL)
3066                     | B43_MACCTL_INFRA);
3067
3068         /* Probe Response Timeout value */
3069         /* FIXME: Default to 0, has to be set by ioctl probably... :-/ */
3070         b43_shm_write16(dev, B43_SHM_SHARED, 0x0074, 0x0000);
3071
3072         /* Initially set the wireless operation mode. */
3073         b43_adjust_opmode(dev);
3074
3075         if (dev->dev->core_rev < 3) {
3076                 b43_write16(dev, 0x060E, 0x0000);
3077                 b43_write16(dev, 0x0610, 0x8000);
3078                 b43_write16(dev, 0x0604, 0x0000);
3079                 b43_write16(dev, 0x0606, 0x0200);
3080         } else {
3081                 b43_write32(dev, 0x0188, 0x80000000);
3082                 b43_write32(dev, 0x018C, 0x02000000);
3083         }
3084         b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
3085         b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
3086         b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
3087         b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
3088         b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
3089         b43_write32(dev, B43_MMIO_DMA4_IRQ_MASK, 0x0000DC00);
3090         b43_write32(dev, B43_MMIO_DMA5_IRQ_MASK, 0x0000DC00);
3091
3092         b43_mac_phy_clock_set(dev, true);
3093
3094         switch (dev->dev->bus_type) {
3095 #ifdef CONFIG_B43_BCMA
3096         case B43_BUS_BCMA:
3097                 /* FIXME: 0xE74 is quite common, but should be read from CC */
3098                 b43_write16(dev, B43_MMIO_POWERUP_DELAY, 0xE74);
3099                 break;
3100 #endif
3101 #ifdef CONFIG_B43_SSB
3102         case B43_BUS_SSB:
3103                 b43_write16(dev, B43_MMIO_POWERUP_DELAY,
3104                             dev->dev->sdev->bus->chipco.fast_pwrup_delay);
3105                 break;
3106 #endif
3107         }
3108
3109         err = 0;
3110         b43dbg(dev->wl, "Chip initialized\n");
3111 out:
3112         return err;
3113
3114 err_gpio_clean:
3115         b43_gpio_cleanup(dev);
3116         return err;
3117 }
3118
3119 static void b43_periodic_every60sec(struct b43_wldev *dev)
3120 {
3121         const struct b43_phy_operations *ops = dev->phy.ops;
3122
3123         if (ops->pwork_60sec)
3124                 ops->pwork_60sec(dev);
3125
3126         /* Force check the TX power emission now. */
3127         b43_phy_txpower_check(dev, B43_TXPWR_IGNORE_TIME);
3128 }
3129
3130 static void b43_periodic_every30sec(struct b43_wldev *dev)
3131 {
3132         /* Update device statistics. */
3133         b43_calculate_link_quality(dev);
3134 }
3135
3136 static void b43_periodic_every15sec(struct b43_wldev *dev)
3137 {
3138         struct b43_phy *phy = &dev->phy;
3139         u16 wdr;
3140
3141         if (dev->fw.opensource) {
3142                 /* Check if the firmware is still alive.
3143                  * It will reset the watchdog counter to 0 in its idle loop. */
3144                 wdr = b43_shm_read16(dev, B43_SHM_SCRATCH, B43_WATCHDOG_REG);
3145                 if (unlikely(wdr)) {
3146                         b43err(dev->wl, "Firmware watchdog: The firmware died!\n");
3147                         b43_controller_restart(dev, "Firmware watchdog");
3148                         return;
3149                 } else {
3150                         b43_shm_write16(dev, B43_SHM_SCRATCH,
3151                                         B43_WATCHDOG_REG, 1);
3152                 }
3153         }
3154
3155         if (phy->ops->pwork_15sec)
3156                 phy->ops->pwork_15sec(dev);
3157
3158         atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
3159         wmb();
3160
3161 #if B43_DEBUG
3162         if (b43_debug(dev, B43_DBG_VERBOSESTATS)) {
3163                 unsigned int i;
3164
3165                 b43dbg(dev->wl, "Stats: %7u IRQs/sec, %7u TX/sec, %7u RX/sec\n",
3166                        dev->irq_count / 15,
3167                        dev->tx_count / 15,
3168                        dev->rx_count / 15);
3169                 dev->irq_count = 0;
3170                 dev->tx_count = 0;
3171                 dev->rx_count = 0;
3172                 for (i = 0; i < ARRAY_SIZE(dev->irq_bit_count); i++) {
3173                         if (dev->irq_bit_count[i]) {
3174                                 b43dbg(dev->wl, "Stats: %7u IRQ-%02u/sec (0x%08X)\n",
3175                                        dev->irq_bit_count[i] / 15, i, (1 << i));
3176                                 dev->irq_bit_count[i] = 0;
3177                         }
3178                 }
3179         }
3180 #endif
3181 }
3182
3183 static void do_periodic_work(struct b43_wldev *dev)
3184 {
3185         unsigned int state;
3186
3187         state = dev->periodic_state;
3188         if (state % 4 == 0)
3189                 b43_periodic_every60sec(dev);
3190         if (state % 2 == 0)
3191                 b43_periodic_every30sec(dev);
3192         b43_periodic_every15sec(dev);
3193 }
3194
3195 /* Periodic work locking policy:
3196  *      The whole periodic work handler is protected by
3197  *      wl->mutex. If another lock is needed somewhere in the
3198  *      pwork callchain, it's acquired in-place, where it's needed.
3199  */
3200 static void b43_periodic_work_handler(struct work_struct *work)